CVE-2023-36287

Deeper analysis

An unauthenticated cross-site scripting vulnerability exists in Webkul QloApps version 1.6.0 and is tracked as CVE-2023-36287. The flaw is a classic CWE-79 instance that resides in the handling of the controller parameter supplied via POST requests, allowing script injection without any authentication or special privileges.

An attacker can supply a crafted POST request containing malicious JavaScript in the controller parameter; because the application reflects the value without adequate output encoding, the script executes in the context of a victim user who visits a link or page under the attacker's control. Successful exploitation yields the victim's session cookie, enabling the attacker to impersonate the user and perform actions within the QloApps application.

The EPSS score for this CVE stands at 0.2046 with no material increase after disclosure. The two reference URLs point to the same technical write-up that first documented the issue but contain no vendor advisory or patch information.