Medium severity · published Feb 6, 2025
CVE-2025-1074
A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Affected is the function logout of the file /en/?mylogout of the component URL Handler. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure. They are aware about it and are working on resolving it.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QL
Qloapps · Webkul
1.6.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-1074
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-1074
Exploit
https://github.com/mano257200/qloapps-csrf-logout-vulnerability
Permissions Required
https://vuldb.com/?ctiid.294834
Third Party Advisory
https://vuldb.com/?id.294834
Third Party Advisory
https://vuldb.com/?submit.491600
More from Qloapps
9.8
CVE-2025-67325
Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution
7.5
CVE-2023-36284
An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remote attacker to bypass a web…
7.2
CVE-2026-75498
Webkul QloApps SQL injection
7.2
CVE-2026-75497
Webkul QloApps SQL injection
7.2
CVE-2026-75496
Webkul QloApps improper file upload validation