CVE-2023-30256

Deeper analysis

CVE-2023-30256 is a reflected cross-site scripting vulnerability in Webkil QloApps version 1.5.2. The flaw is located in AuthController.php and is triggered by unsanitized input supplied to the back and email_create parameters, allowing an attacker to inject arbitrary script that executes in a victim's browser.

A remote unauthenticated attacker can exploit the issue by crafting a malicious link or request that causes the application to reflect attacker-controlled content back to the victim. Successful exploitation yields the ability to obtain sensitive information such as session tokens or other data accessible within the victim's browser context, consistent with the reported CVSS vector of network attack, low complexity, no privileges required, and user interaction.

The supplied references consist of a public proof-of-concept and the project's repository but contain no details on official patches or mitigation steps. The associated EPSS score has remained flat at its peak value of 0.7813 with no material increase after disclosure.