Description
Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c.
Published: 2026-08-25
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote data breach via SQL injection
Action: Immediate Patch
AI Analysis

Impact

Webkul QloApps allows SQL injection because the bo_query request parameter is used directly in a database query without validation. If an attacker can authenticate with an account that has administrative rights, they can submit a crafted payload to this parameter and execute arbitrary SQL. This can lead to disclosure of sensitive customer data, modification of records, or potentially full database takeover, affecting confidentiality, integrity, and availability of the application.

Affected Systems

Affected systems are deployments of Webkul QloApps where the vulnerable CustomerMessage.php file is present. The patch commit 123c97c rectifies the issue. No specific version numbers are listed, so it is recommended to upgrade any installation that contains the old code path.

Risk and Exploitability

The vulnerability has a CVSS score of 8.6, indicating a high severity. EPSS data is not available, and it is not listed in the CISA KEV catalog. The exploit requires remote authenticated access, meaning only users with administrative privileges can leverage it. Given the high CVSS rating and the lack of mitigations by default, the risk for affected installations is considerable and should be addressed promptly.

Generated by OpenCVE AI on August 25, 2026 at 20:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor patch that includes commit 123c97c to the QloApps codebase.
  • Restrict administrative account usage or enforce least privilege, ensuring that only trusted users can access the bo_query functionality.
  • Implement input validation or use prepared statements for all database queries involving user‑supplied parameters, following CWE‑89 mitigation guidelines.

Generated by OpenCVE AI on August 25, 2026 at 20:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Webkul
Webkul qloapps
Vendors & Products Webkul
Webkul qloapps

Tue, 25 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 25 Aug 2026 17:00:00 +0000

Type Values Removed Values Added
Description Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c.
Title Webkul QloApps SQL injection
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Webkul Qloapps
cve-icon MITRE

Status: PUBLISHED

Assigner: cisa-cg

Published:

Updated: 2026-08-25T18:05:58.384Z

Reserved: 2026-08-17T20:16:01.457Z

Link: CVE-2026-75497

cve-icon Vulnrichment

Updated: 2026-08-25T18:05:54.578Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-25T17:18:16.187

Modified: 2026-08-26T16:52:20.850

Link: CVE-2026-75497

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-25T21:00:04Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')