Description
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restriction_min_los and restriction_max_los parameters, executing arbitrary JavaScript in the victim's administrative session.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Webkul QloApps
Default version status: unaffected
0 to ≤ 1.7.0affected
pkg:github/Qloapps/QloAppsReferences
- https://github.com/Qloapps/QloApps/pull/1899 ↗
- https://github.com/Qloapps/QloApps/commit/7ed467d911086b190180d7f297e3b15ba31e82d5 ↗
- https://github.com/Qloapps/QloApps/blob/v1.7.0/admin/themes/default/template/controllers/products/lengthofstay.tpl ↗
- https://hackmd.io/@leediay/four-reflected-xss-qloapps ↗
- https://github.com/Qloapps/QloApps ↗
- https://www.vulncheck.com/advisories/qloapps-through-1.7.0-reflected-xss-via-length-of-stay-fields ↗