CVE-2021-41074 PoC — QloApps 安全漏洞

Source

https://github.com/dillonkirsch/CVE-2021-41074

Associated Vulnerability

Title:QloApps 安全漏洞 (CVE-2021-41074)
Description:A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document.

Description

CSRF in Qloapps HotelCommerce 1.5.1

Readme

# CVE-2021-41074
CSRF in Qloapps HotelCommerce 1.5.1

There is a CSRF in HotelCommerce 1.5.1. It can allow anyone to change the admin email. 

If an attacker gets an admin to click a maliciously crafted html document, they can change the admin user email.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!