Description

QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary JavaScript in the victim's session to read administrative data and perform actions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-12T02:16:24.623Z",
  "pubdate": "2026-09-12T02:16:24.623Z",
  "executiveSummary": "QloApps versions up to and including 1.7.0 contain a Reflected Cross-Site Scripting (XSS) vulnerability located within its back-office list filtering functionality.\nThe vulnerability arises due to the improper neutralization of user-supplied POST parameters before they are rendered into the HTML document as attribute values.\nSuccessful exploitation allows an unauthenticated or low-privileged attacker to execute arbitrary JavaScript within the security context of an authenticated administrator's session.\nThis compromise enables a range of malicious activities, including session hijacking, unauthorized administrative actions, and the exfiltration of sensitive internal data.\nThe attack is contingent upon social engineering or forced submission, where an attacker induces an authenticated user to process a malicious, crafted request.\nThe risk is categorized as high, as it bypasses standard security controls by leveraging the trust associated with the administrator's authenticated session.\nImmediate remediation is required to sanitize all dynamic content rendered in the administrative interface.",
  "technicalDetails": "The vulnerability is identified as a Reflected Cross-Site Scripting (XSS) flaw located in the back-office list helper template of QloApps 1.7.0.\nRoot cause analysis reveals that the application fails to perform adequate output encoding or context-aware sanitization when processing POST request parameters used for list filtering. Specifically, when these parameters are returned to the user in the HTTP response, they are directly injected into the 'value' attribute of HTML input tags without prior escaping of special characters.\nAn attacker can exploit this by crafting a malicious payload containing JavaScript sequences—for instance, breaking out of the attribute context using a double quote and introducing an 'onerror' or 'onload' event handler. The payload is delivered through a manipulated POST request targeting the list controller.\nThe attack flow follows a structured path: First, the attacker identifies a legitimate list controller endpoint within the QloApps back-office. Second, the attacker crafts a malicious request where the filtering parameters contain JavaScript payloads. Third, the attacker uses social engineering or a malicious cross-site request (CSRF) mechanism to trick an authenticated administrator into submitting this crafted request to the application. Fourth, the application processes the request, fails to sanitize the malicious input, and renders the payload inside the HTML input tag of the response page.\nWhen the administrator's browser renders this HTML, the payload is executed in the context of the active session. Because the script executes within the victim's browser session, it inherits the administrator's permissions. This allows the attacker to perform actions such as retrieving CSRF tokens to bypass protection mechanisms, modifying system configurations, creating new administrative accounts, or reading sensitive sensitive data displayed on the dashboard.\nThe vulnerability resides in the core template processing logic responsible for list rendering in the back-office components. As the platform renders these values server-side and reflects them immediately back to the client-side interface, the vulnerability is classified as reflected, necessitating an active interaction between the target user and the malicious input. The flaw persists across all environments utilizing QloApps 1.7.0 and earlier that share the vulnerable list helper code structure."
}