CyberRota Analysis
AI-GeneratedQloApps versions up to 1.7.0 are vulnerable due to improper handling of back-office list filter POST parameters, allowing attackers to inject malicious JavaScript through crafted requests. This can lead to unauthorized access to administrative data and actions within an authenticated user's session. Organizations using QloApps, particularly those with administrative functionalities exposed to user input, should prioritize addressing this vulnerability to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary JavaScript in the victim's session to read administrative data and perform actions.