Threats affecting pkg:github/QloApps

QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed review_ajax_token and enumerate sequential id_order values to post fake ratings and reviews attributed to other customers.

QloApps versions up to 1.7.0 have an authorization bypass vulnerability in the OrderConfirmationController::init() function. This flaw allows unauthenticated attackers to sequentially guess guest id_cart values to obtain guest order references and emails. Attackers can read redirect headers, view booking details, and convert guest accounts into full accounts with attacker-chosen passwords.

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims' service lines, and corrupt refund quantities.

QloApps versions up to 1.7.0 have an improper access control vulnerability in the AdminSlipController. This flaw allows hotel-restricted back-office employees to access credit slips belonging to other hotels. Exploitation enables attackers to list, export, mark as redeemed, and generate store-credit vouchers from refund records of other hotels, exposing sensitive customer information such as identities and refund amounts.

QloApps versions up to 1.7.0 have a broken access control vulnerability allowing hotel-restricted back-office employees to create room types under hotels they are not assigned to by manipulating the hotel ID parameter. This enables unauthorized creation of rooms and inventory for other hotels via the AdminProductsController. The vulnerability has a medium severity with a CVSS score of 5.3.

QloApps versions up to and including 1.7.0 have a reflected cross-site scripting (XSS) vulnerability in the AdminSearchConfController::processSave() function. This flaw occurs because rejected alias and search values are echoed back unescaped in validation error messages. An attacker can exploit this by tricking an authenticated back-office user into submitting a specially crafted request, leading to execution of arbitrary JavaScript in the administrative session.

QloApps versions up to 1.7.0 have a reflected cross-site scripting (XSS) vulnerability in the AdminHotelFeaturePricesSettings form. This flaw occurs because the application echoes certain POST parameters without proper escaping after validation failure. An attacker can exploit this by tricking an authenticated back-office user into submitting a crafted request, leading to JavaScript execution in the admin session.

QloApps versions up to 1.7.0 contain a reflected cross-site scripting (XSS) vulnerability in the back-office Additional Facilities form. This flaw allows remote attackers to inject malicious scripts via the price parameter. When an authenticated back-office user submits a crafted request with an unescaped price value that fails validation, the injected JavaScript executes in their administrative session.

QloApps versions up to 1.7.0 have an insecure direct object reference vulnerability in several back-office AJAX handlers. This flaw allows hotel-restricted employees to bypass hotel access checks by supplying other hotels' identifiers, enabling unauthorized reading, uploading, and deletion of booking documents, as well as deletion of rooms and images.

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess() that allows restricted back-office employees to access other hotels' data by supplying an id_hotel parameter. Attackers can modify the id_hotel URL parameter on the Book Now page to view room availability and booking status of hotels outside their assigned profile access.

QloApps versions up to 1.7.0 have an authorization bypass vulnerability in the AdminProductsController::ajaxProcessBulkUpdateRooms function. This flaw allows hotel-restricted back-office employees to modify rooms belonging to other hotels by submitting foreign room IDs. The unauthorized changes can affect room status, floor, comments, or inactive dates, potentially disrupting room availability and bookings.

QloApps versions up to and including 1.7.0 have a reflected cross-site scripting (XSS) vulnerability in the back-office room type editor's length of stay fields. Authenticated administrators can be tricked into submitting crafted POST requests with malicious JavaScript payloads in the restriction_min_los and restriction_max_los parameters, leading to script execution within their administrative session.

QloApps versions up to 1.7.0 contain a reflected cross-site scripting (XSS) vulnerability in the back-office room type editor. The vulnerability arises because the application does not properly escape certain input fields (room_num, floor, comment) in HTML input attributes. Authenticated back-office users can be tricked into submitting malicious POST requests that execute arbitrary JavaScript in their administrative sessions. This vulnerability has a medium severity rating with a CVSS score of 5.1.

QloApps versions up to 1.7.0 contain a reflected cross-site scripting (XSS) vulnerability in the back-office Transplant a module form's exceptions field. An attacker can craft a malicious URL with a JavaScript payload in the exceptions parameter that executes in an authenticated administrator's session when clicked. This vulnerability requires the victim to be an authenticated administrator and to interact with the malicious link.

QloApps versions up to 1.7.0 have a reflected cross-site scripting (XSS) vulnerability in the back-office Hotel Reservation System Book Now search feature. The vulnerability arises because the date_to and id_room_type parameters are inserted into template variables without proper validation. An attacker can craft a malicious URL containing JavaScript payloads in these parameters, which executes in an authenticated administrator's session if the link is followed.

QloApps versions up to 1.7.0 have a path traversal vulnerability in the getEmailHTML action of admin/ajax.php. Authenticated back-office users can exploit this flaw by supplying relative path sequences in the email parameter to read arbitrary files, potentially exposing sensitive information such as database credentials and configuration data.

QloApps versions up to 1.7.0 contain a cross-site scripting (XSS) vulnerability in the Hotel Reservation System feature management page. This occurs because child feature names are reflected without proper escaping in back-office validation error messages. Authenticated back-office users who click a crafted link can execute injected JavaScript within their administrative session.

QloApps versions up to 1.7.0 contain a cross-site scripting (XSS) vulnerability in the back-office list filter functionality. The application improperly escapes POST parameters rendered into HTML input value attributes, allowing authenticated users to submit crafted requests that execute arbitrary JavaScript. This can lead to unauthorized reading of administrative data and performing actions within the victim's session.