Threats tagged 'ghsa-g7m3-95cx-3cxg'

QloApps versions up to 1.7.0 have an information disclosure vulnerability in the OrderConfirmationController::init() function. This flaw allows unauthenticated attackers to enumerate guest order references and associated emails by supplying sequential guest id_cart values. Attackers can read the Location redirect header to access booking details via guest tracking and potentially convert guest accounts into full user accounts with attacker-chosen passwords.