CVE-2026-75497: Webkul QloApps SQL Injection Vulnerability

CVE-2026-75497 Overview

CVE-2026-75497 is a SQL injection vulnerability in Webkul QloApps, an open-source hotel booking and reservation platform. The application fails to validate request parameters before passing them to a database query. An authenticated attacker with administrative privileges can supply a crafted SQL payload to the bo_query parameter in CustomerMessage.php and execute arbitrary SQL statements against the backend database. The issue is tracked under CWE-89 and has been fixed in commit 123c97c.

Critical Impact
Successful exploitation allows an authenticated administrator to read, modify, or delete arbitrary data in the QloApps database, including guest records, reservation data, and credentials.

Affected Products

Webkul QloApps (versions prior to commit 123c97c)
QloApps back-office CustomerMessage.php component
Deployments exposing the QloApps admin interface to authenticated users

Discovery Timeline

2026-08-25 - CVE-2026-75497 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75497

Vulnerability Analysis

The flaw resides in the QloApps back-office message-handling code in CustomerMessage.php. The controller reads the bo_query request parameter and concatenates the value directly into a SQL statement without parameter binding or input sanitization. Because the query is executed with the credentials of the QloApps database user, an attacker can pivot from parameter injection to arbitrary SQL execution.

Exploitation requires an authenticated session with administrative privileges in the QloApps back office. Once authenticated, an attacker submits a request containing SQL metacharacters in the bo_query field. The server-side handler concatenates the payload into a query executed via QloApps' database abstraction layer, allowing UNION-based extraction, boolean-based inference, or stacked queries depending on the underlying database driver.

The upstream fix, committed in 123c97c via Qloapps/QloApps pull request #1783, introduces input validation and parameterized query handling for the affected code path.

Root Cause

The root cause is missing input validation and unsafe string concatenation when building SQL from the bo_query request parameter. QloApps did not apply the framework's parameter binding functions before executing the query, violating standard defenses against CWE-89 SQL Injection.

Attack Vector

The attack vector is network-based over HTTP/HTTPS to the QloApps administrative interface. The attacker must hold administrative credentials or hijack an authenticated admin session. Because the vulnerable endpoint is reachable from any network path that exposes the back office, internet-facing QloApps deployments are at greatest risk. No user interaction is required beyond the attacker's own authenticated request.

For payload structure and the corrected code path, review the QloApps pull request #1783 diff and the CSAF vulnerability assessment report.

Detection Methods for CVE-2026-75497

Indicators of Compromise

HTTP requests to QloApps administrative endpoints containing SQL metacharacters (', --, UNION, SELECT, SLEEP) in the bo_query parameter.
Web server access logs referencing CustomerMessage.php with unusually long or URL-encoded bo_query values.
Database error entries or unexpected INFORMATION_SCHEMA queries originating from the QloApps application user.
New or modified administrator accounts and unexpected changes to booking or customer tables.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect the bo_query parameter on requests to CustomerMessage.php and block SQL syntax tokens.
Enable database query auditing and alert on statements referencing system tables from the QloApps service account.
Correlate authenticated admin session identifiers with anomalous query patterns to spot session-riding or credential misuse.

Monitoring Recommendations

Forward QloApps web logs and MySQL/MariaDB audit logs to a central SIEM for retention and correlation.
Alert on admin logins from new geolocations or IP ranges preceding requests to CustomerMessage.php.
Baseline typical response sizes for the affected endpoint and flag outliers that may indicate data exfiltration via UNION-based injection.

How to Mitigate CVE-2026-75497

Immediate Actions Required

Update QloApps to a build that includes commit 123c97c from pull request #1783.
Rotate all QloApps administrator credentials and invalidate active admin sessions.
Review database contents for unauthorized modifications to customer, booking, and user tables.

Patch Information

The vendor fix is available in the QloApps repository under commit 123c97c, merged via QloApps pull request #1783. The patch applies input validation and parameterized queries to the CustomerMessage.php handler. Administrators running QloApps from source should pull the latest master branch or apply the referenced commit directly and redeploy.

Workarounds

Restrict access to the QloApps back office by IP allowlist or VPN until the patch is applied.
Enforce multi-factor authentication (MFA) on all administrator accounts to raise the bar for credential abuse.
Deploy a WAF rule to block requests to CustomerMessage.php where the bo_query parameter contains SQL syntax characters.
Apply the principle of least privilege to the QloApps database account, revoking FILE, CREATE, and DROP rights where feasible.

bash

# Apply the upstream fix from the QloApps repository
cd /var/www/qloapps
git fetch origin
git checkout 123c97c110b7053ea3297d8e58fe95b3c3536560 -- controllers/admin/CustomerMessage.php

# Example ModSecurity rule to block SQL tokens in bo_query
SecRule ARGS:bo_query "@rx (?i)(union(\s|/\*.*\*/)+select|select.+from|sleep\(|--|;)" \
    "id:1075497,phase:2,deny,status:403,msg:'CVE-2026-75497 QloApps bo_query SQLi attempt'"