Description
QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, and generate store-credit vouchers from other hotels' refund records, exposing customer identities and amounts.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Webkul QloApps
Default version status: unaffected
0 to ≤ 1.7.0affected
pkg:github/Qloapps/QloAppsReferences
- https://hackmd.io/@leediay/SyMoELioMx ↗
- https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/admin/AdminSlipController.php#L33-L41 ↗
- https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/admin/AdminSlipController.php#L160-L229 ↗
- https://github.com/Qloapps/QloApps/blob/v1.7.0/classes/order/OrderSlip.php#L273-L288 ↗
- https://github.com/Qloapps/QloApps/pull/1650 ↗
- https://github.com/Qloapps/QloApps/commit/a759ae96d0d01e982d40f96d357c94bb30f3a7b3 ↗
- https://github.com/Qloapps/QloApps ↗
- https://www.vulncheck.com/advisories/qloapps-through-1.7.0-missing-hotel-access-restriction-in-credit-slips ↗