Description
QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed review_ajax_token and enumerate sequential id_order values to post fake ratings and reviews attributed to other customers.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
qloapps qloapps
Default version status: unaffected
1.6.0 to ≤ 1.7.0affected
pkg:github/qloapps/qloappsReferences
- https://github.com/Qloapps/QloApps/pull/1757 ↗
- https://github.com/Qloapps/QloApps/commit/d5ce1333c99b9619fc17412580fbb28c02be2580 ↗
- https://github.com/Qloapps/QloApps ↗
- https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/qlohotelreview/controllers/front/default.php#L37-L104 ↗
- https://www.vulncheck.com/advisories/qloapps-1.6.0-through-1.7.0-unauthorized-hotel-review-submission-via-qlohotelreview ↗