Description
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave() that echoes rejected alias and search values unescaped in validation errors. Attackers can induce an authenticated back-office user to submit a crafted request, executing JavaScript in that user's administrative session.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Webkul QloApps
Default version status: unaffected
0 to ≤ 1.7.0affected
pkg:github/Qloapps/QloAppsReferences
- https://hackmd.io/@leediay/SyMoELioMx ↗
- https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/admin/AdminSearchConfController.php#L328-L343 ↗
- https://github.com/Qloapps/QloApps/blob/v1.7.0/admin/themes/default/template/alerts.tpl#L35-L43 ↗
- https://github.com/Qloapps/QloApps ↗
- https://www.vulncheck.com/advisories/qloapps-through-1.7.0-reflected-xss-via-search-alias-validation-errors ↗