| शीर्षक | webkul qloapps 1.7.0 Authorization Bypass |
|---|
| विवरण | The logout functionality in QloApps exposes the CSRF token directly in the URL and allows it to be reused multiple times. This makes the CSRF protection ineffective and introduces multiple risks:
Token exposure via browser history, referrer headers, and logs.
Replay attacks since the token does not expire after first use.
Forced logout attacks, where an attacker can log out users repeatedly without their consent.
Potential authorization bypass if the same flawed CSRF mechanism is applied to sensitive actions like profile changes, checkout, or administrative tasks.
This issue falls under CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-352 (Cross-Site Request Forgery). |
|---|
| स्रोत | ⚠️ https://github.com/Ryomensukuna13/QloApps-Reusable-CSRF-Token-in-Logout-Functionality/blob/main/README.md |
|---|
| उपयोगकर्ता | Ragavendra Krishna Kumar (UID 89760) |
|---|
| सबमिशन | 02/09/2025 05:40 PM (1 वर्ष पहले) |
|---|
| संयम | 20/09/2025 09:01 AM (18 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 325114 [Webkul QloApps तक 1.7.0 CSRF Token token अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|