CVE-2023-36287

MEDIUMNuclei

Webkul QloApps 1.6.0 - Cross-site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2023-36287 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 29, 2024 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryMEDIUMWebkul QloApps 1.6.0 - Cross-site ScriptingCVSS 6.1

An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.

Remediation

To remediate this issue, it is recommended to apply the latest security patches or updates provided by the vendor.

WeaknessesCWE-79
Authorstheamanrawat
Template tagscve2023cvexsswebkul-qloappsunauthwebkulvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:webkul:qloapps:1.6.0:*:*:*:*:*:*:*
FOFA: title="qloapps"
https://github.com/webkul/hotelcommerce https://flashy-lemonade-192.notion.site/Cross-site-scripting-via-controller-parameter-in-QloApps-1-6-0-97e409ce164f40d195b625b9bf719900 https://nvd.nist.gov/vuln/detail/CVE-2023-36287

Source: ProjectDiscovery

References

2