Webkul QloApps fails to validate request parameters before constructing a SQL query. An attacker who is authenticated with admin privileges can inject malicious SQL through the 'bo_query' parameter in the Address.php file, yielding arbitrary query execution and potential data exfiltration or modification.

The vulnerability affects Webkul's QloApps product. No specific version list is provided, so any current release prior to the commit that introduces the fix is potentially impacted.

The CVSS score of 8.6 marks the flaw as high severity. With the EPSS score unavailable and no listing in CISA's KEV catalog, the overall exploitation probability is uncertain, but the need for administrative credentials elevates the risk for any accounts that have elevated privileges. Attackers must remotely send a crafted request to trigger the injection.