CVE-2026-75498: Webkul QloApps SQL Injection Vulnerability

CVE-2026-75498 Overview

CVE-2026-75498 is a SQL injection vulnerability in Webkul QloApps, an open-source hotel reservation and booking management system. The application fails to validate request parameters before passing them to a database query. An authenticated attacker with administrative privileges can send a crafted SQL payload through the bo_query parameter in Address.php. The flaw is categorized under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. The issue is resolved in commit 123c97c.

Critical Impact
Authenticated administrators can execute arbitrary SQL against the QloApps database, exposing guest reservation data, payment records, and stored credentials.

Affected Products

Webkul QloApps (versions prior to commit 123c97c)
QloApps Address.php administrative backend component
Deployments exposing the bo_query request parameter

Discovery Timeline

2026-08-25 - CVE-2026-75498 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75498

Vulnerability Analysis

QloApps concatenates the bo_query request parameter directly into a database query executed by the Address.php administrative controller. The application does not sanitize, escape, or parameterize the input before it reaches the database layer. An authenticated user with administrative privileges can inject arbitrary SQL clauses to read, modify, or delete records outside the intended query scope. Because QloApps stores customer profiles, reservation details, and payment metadata, exploitation directly affects confidentiality, integrity, and availability of hotel operations data. The fix in commit 123c97c introduces input validation on the vulnerable parameter path.

Root Cause

The root cause is missing input neutralization on the bo_query parameter. The controller trusts client-supplied input from an authenticated back-office session and forwards it into a dynamically constructed SQL statement. This pattern eliminates the type and syntax boundary between user data and executable SQL, which is the defining condition of CWE-89.

Attack Vector

Exploitation requires network access to the QloApps back-office and valid administrative credentials. An attacker who has phished, brute-forced, or otherwise obtained an admin session issues an HTTP request to the Address.php endpoint with a malicious bo_query value containing SQL syntax such as UNION SELECT or stacked statements. The database executes the injected clause with the privileges of the QloApps database user. See the upstream patch diff for the exact code path.

Detection Methods for CVE-2026-75498

Indicators of Compromise

HTTP requests to Address.php containing SQL keywords such as UNION, SELECT, SLEEP, INFORMATION_SCHEMA, or -- in the bo_query parameter
Unusual admin-session activity originating from new IP addresses or geolocations
Database error entries or long-running queries traced to the QloApps back-office user

Detection Strategies

Deploy web application firewall signatures that inspect bo_query values for SQL metacharacters and known injection payloads
Enable MySQL general or slow query logging and alert on queries containing unbounded UNION or INFORMATION_SCHEMA references sourced from Address.php
Review web server access logs for repeated non-2xx responses to Address.php following authenticated admin logins

Monitoring Recommendations

Baseline the volume and shape of legitimate bo_query requests and alert on statistical deviations
Correlate admin authentication events with subsequent database read volume to identify data exfiltration attempts
Forward web, application, and database logs to a centralized analytics platform for cross-source correlation

How to Mitigate CVE-2026-75498

Immediate Actions Required

Apply the upstream patch by updating QloApps to a build that includes commit 123c97c
Rotate all administrative credentials and invalidate active back-office sessions
Restrict administrative endpoints to trusted source IP ranges via network or reverse-proxy controls
Audit the QloApps database for unauthorized schema reads, data modifications, or new privileged accounts

Patch Information

The vulnerability is fixed in QloApps commit 123c97c. Review the GitHub pull request changes for the exact code modifications. Consult the CISA CSAF advisory and the official CVE record for coordinated disclosure details.

Workarounds

Enforce multi-factor authentication on all QloApps administrative accounts to raise the cost of credential compromise
Place the back-office behind a VPN or zero-trust access proxy to remove direct internet exposure
Deploy a WAF rule that rejects requests to Address.php where bo_query contains SQL syntax until patching is complete
Apply the principle of least privilege to the QloApps database user, removing FILE, DROP, and cross-database rights

bash

# Example WAF rule (ModSecurity) blocking SQL syntax in bo_query
SecRule ARGS:bo_query "@rx (?i)(union\s+select|information_schema|sleep\(|--|;)" \
    "id:1075498,phase:2,deny,status:403,\
    msg:'CVE-2026-75498 QloApps bo_query SQLi attempt',\
    logdata:'Matched %{MATCHED_VAR}'"