CVE-2023-36289

MEDIUMNuclei

Webkul QloApps 1.6.0 - Cross-site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2023-36289 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST email_create and back parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 29, 2024 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryMEDIUMWebkul QloApps 1.6.0 - Cross-site ScriptingCVSS 6.1

An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST email_create and back parameter.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.

Remediation

To remediate this issue, it is recommended to apply the latest security patches or updates provided by the vendor.

WeaknessesCWE-79
Authorstheamanrawat
Template tagscve2023cvexsswebkul-qloappsunauthwebkulvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:webkul:qloapps:1.6.0:*:*:*:*:*:*:*
FOFA: title="qloapps"
https://github.com/webkul/hotelcommerce https://flashy-lemonade-192.notion.site/Cross-site-scripting-in-POST-Request-via-email_create-and-back-parameter-in-QloApps-1-6-0-e05548203d744daf9047d82fc94b19b7 https://nvd.nist.gov/vuln/detail/CVE-2023-36289

Source: ProjectDiscovery

References

2