Threats tagged 'ghsa-r73j-mrwx-7crw'

QloApps versions 1.6.0 through 1.7.0 have a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action. This flaw allows unauthenticated attackers to submit reviews for arbitrary orders by reusing a publicly exposed review_ajax_token and enumerating sequential order IDs. The vulnerability enables attackers to post fake ratings and reviews attributed to other customers without authentication.