CVE-2026-75498: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Webkul QloApps

Webkul QloApps contains an SQL injection vulnerability (CWE-89) due to improper neutralization of special elements in the 'bo_query' parameter within 'Address.php'. This flaw permits a remote, authenticated attacker with admin privileges to inject malicious SQL commands. The vulnerability has a CVSS 3.1 score of 7.2 (high), indicating network attack vector, low attack complexity, high privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. The issue is fixed in commit 123c97c, but no formal patch or vendor advisory is currently available.

Successful exploitation allows an authenticated administrator to execute arbitrary SQL commands, leading to potential full compromise of the database, including unauthorized data disclosure, modification, or deletion, and possible denial of service. The vulnerability affects the confidentiality, integrity, and availability of the system.

A fix has been implemented in the codebase (commit 123c97c). Users should apply this fix or update to a version including this commit once officially released. Until then, restrict administrative access and monitor for suspicious activity. Patch status is not yet confirmed via a vendor advisory; check Webkul's official channels for updated remediation guidance.