Description
Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Webkul | QloApps | < 123c97c | 123c97c |
Advisories 1
- VA-26-237-01 Webkul QloApps multiple vulnerabilities CISA ICS & IT advisories · Aug 25, 2026