CVE-2025-1074
Webkul QloApps URL mylogout cross-site request forgery
- State
- Published
- Severity
- 5.3 Medium
- Published
- Feb 6, 2025
- Updated
- Feb 6, 2025
- Reserved
- Feb 6, 2025
Description
A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Affected is the function logout of the file /en/?mylogout of the component URL Handler. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure. They are aware about it and are working on resolving it.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N | VulDB |
| 2.0 | 5.0 Medium | AV:N/AC:L/Au:N/C:N/I:P/A:N | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
QloAppsWebkul |
|
References
- VDB-294834 | Webkul QloApps URL mylogout cross-site request forgeryvdb-entrytechnical-description
- VDB-294834 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #491600 | webkul qloapps 1.6.1 Cross-Site Request Forgerythird-party-advisory
- https://github.com/mano257200/qloapps-csrf-logout-vulnerabilityexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.