Description
QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims' service lines, and corrupt refund quantities.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Webkul QloApps
Default version status: unaffected
0 to ≤ 1.7.0affected
pkg:github/Qloapps/QloAppsReferences
- https://github.com/Qloapps/QloApps/pull/1930 ↗
- https://github.com/Qloapps/QloApps/commit/105241f9a77e94b30d6c2d577d14b247f33a5fba ↗
- https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/front/OrderDetailController.php#L624-L631 ↗
- https://github.com/Qloapps/QloApps ↗
- https://www.vulncheck.com/advisories/qloapps-through-1.7.0-idor-via-orderdetailcontroller-refund-request ↗