Vulnerability in Webkul QloApps

[ Description ]Official description

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims' service lines, and corrupt refund quantities.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/Qloapps/QloApps
• github.com/Qloapps/QloApps/blob/v1.7.0/controllers/front/OrderDetailController.php
• github.com/Qloapps/QloApps/commit/105241f9a77e94b30d6c2d577d14b247f33a5fba
• github.com/Qloapps/QloApps/pull/1930
• www.vulncheck.com/advisories/qloapps-through-1.7.0-idor-via-orderdetailcontroller-refun…