Description
Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'Address.php' file. Fixed in 123c97c.
Published: 2026-08-25
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL injection via authenticated administrative access
Action: Patch promptly
AI Analysis

Impact

Webkul QloApps fails to validate request parameters before constructing a SQL query. An attacker who is authenticated with admin privileges can inject malicious SQL through the 'bo_query' parameter in the Address.php file, yielding arbitrary query execution and potential data exfiltration or modification.

Affected Systems

The vulnerability affects Webkul's QloApps product. No specific version list is provided, so any current release prior to the commit that introduces the fix is potentially impacted.

Risk and Exploitability

The CVSS score of 8.6 marks the flaw as high severity. With the EPSS score unavailable and no listing in CISA's KEV catalog, the overall exploitation probability is uncertain, but the need for administrative credentials elevates the risk for any accounts that have elevated privileges. Attackers must remotely send a crafted request to trigger the injection.

Generated by OpenCVE AI on August 25, 2026 at 20:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest fix from commit 123c97c that validates the bo_query parameter before use
  • Ensure that only trusted administrators have access to the back‑office and apply least‑privilege principles
  • Deploy a web application firewall rule set to detect and block common SQL injection patterns on the bo_query endpoint

Generated by OpenCVE AI on August 25, 2026 at 20:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Webkul
Webkul qloapps
Vendors & Products Webkul
Webkul qloapps

Tue, 25 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 25 Aug 2026 17:00:00 +0000

Type Values Removed Values Added
Description Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'Address.php' file. Fixed in 123c97c.
Title Webkul QloApps SQL injection
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Webkul Qloapps
cve-icon MITRE

Status: PUBLISHED

Assigner: cisa-cg

Published:

Updated: 2026-08-25T18:06:22.590Z

Reserved: 2026-08-17T20:16:01.457Z

Link: CVE-2026-75498

cve-icon Vulnrichment

Updated: 2026-08-25T18:06:15.811Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-25T17:18:16.330

Modified: 2026-08-26T16:52:20.850

Link: CVE-2026-75498

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-25T21:00:04Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')