Executive brief
Webkul QloApps is a point-of-sale and eCommerce platform. An authenticated administrator can send a specially crafted SQL query through an unvalidated request parameter in the Address.php file to extract, modify, or delete database contents, compromising customer data and business operations.
Technical details
The vulnerability is a SQL injection (SQLi) flaw in the Address.php file where the 'bo_query' request parameter is passed directly to a database query without proper validation or parameterized queries. An authenticated attacker with administrative privileges can craft a malicious SQL statement to escape the intended query context and execute arbitrary SQL commands. The attack requires network access to the application and valid administrative credentials. A successful exploit allows the attacker to read, modify, or delete sensitive data in the underlying database. The fix, committed in hash 123c97c, improves request parameter validation for filter queries.
Affected products
- Webkul QloApps before 123c97c
Timeline
- 2026-08-25: disclosed
- 2026-07-14: patched: Fix committed as 123c97c