Login Request a demo
High severity · published Jun 17, 2025
CVE-2025-6173
A vulnerability classified as critical was found in Webkul QloApps 1.6.1
7.2
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability classified as critical was found in Webkul QloApps 1.6.1. Affected by this vulnerability is an unknown functionality of the file /admin/ajax_products_list.php. The manipulation of the argument packItself leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor confirms the existence of this flaw but considers it a low-level issue due to admin privilege pre-requisites. Still, a fix is planned for a future release.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QL
Qloapps · Webkul
1.6.1 · source: NVD
Affected product
QL
Qloapps
Webkul
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-6173
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-6173
Exploit
https://github.com/caigo8/CVE-md/blob/main/QloApps/SQL_Injection.md
Exploit
https://github.com/caigo8/CVE-md/blob/main/QloApps/SQL_Injection.md#vulnerability-recurrence
Permissions Required
https://vuldb.com/?ctiid.312661
Third Party Advisory
https://vuldb.com/?id.312661
Third Party Advisory
https://vuldb.com/?submit.593679
More from Qloapps
9.8
CVE-2025-67325
Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution
7.5
CVE-2023-36284
An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remote attacker to bypass a web…
7.2
CVE-2026-75498
Webkul QloApps SQL injection
7.2
CVE-2026-75497
Webkul QloApps SQL injection
7.2
CVE-2026-75496
Webkul QloApps improper file upload validation