Description
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can craft a malicious link containing JavaScript payload in the exceptions parameter that executes in an authenticated administrator's session when the victim follows the link.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Webkul QloApps
Default version status: unaffected
0 to ≤ 1.7.0affected
pkg:github/Qloapps/QloAppsReferences
- https://github.com/Qloapps/QloApps/pull/1899 ↗
- https://github.com/Qloapps/QloApps/commit/7ed467d911086b190180d7f297e3b15ba31e82d5 ↗
- https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/admin/AdminModulesPositionsController.php ↗
- https://hackmd.io/@leediay/four-reflected-xss-qloapps ↗
- https://github.com/Qloapps/QloApps ↗
- https://www.vulncheck.com/advisories/qloapps-through-1.7.0-reflected-xss-via-exceptions-field ↗