Vulnerability Type: Insecure Direct Object Reference (IDOR) Vulnerable Application: Qloapps Vulnerable Version: v1.5.2 Vulnerable URL: https://localhost/index.php?controller=orderdetail Issue: Ability to manipulate the parameter to cancel test user bookings from a demo user account. Affected Version: Qloapps v1.5.2 Fixed Version: Qloapps v1.6.0 Steps to Reproduce: - Check order history and booking refund requests for both users. - Log in with the demo user account and cancel any booking. - Intercept the request when clicking submit. - Change parameter value to 7 (test user order ID) and send the request. - Verify on test user account. Reference Link: https://github.com/webkul/hotelcommerce/pull/537 CVE: CVE-2023-36235