The vulnerability resides in the Tools::encrypt() function in classes/Tools.php of QloApps versions up to 1.7.0. It uses MD5 to hash passwords concatenated with a static cookie key, making the resulting hash susceptible to offline brute‑force attacks. Because guest-to‑customer account conversion assigns an automatically generated 8‑character password, recovering credentials becomes trivial for an attacker. The weakness is classified as CWE‑916, and the compromise can lead to unauthorized account access.

This weakness affects QloApps 1.7.0. No other product versions were explicitly identified as vulnerable in the provided data.

The CVSS score of 8.2 marks the issue as high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can obtain the MD5 hash from the database and perform offline brute‑force attacks without interacting with the live system. Because the hash uses a static cookie key and the password is short when auto‑generated, the required effort is minimal, making credential recovery and potential takeover likely.