CVE-2026-75497 describes a SQL injection vulnerability in Webkul QloApps, a hotel booking and management platform. The vulnerability exists because the application fails to validate request parameters before passing them to a database query. A remote attacker with administrative privileges can exploit this by sending a crafted SQL payload to the 'bo_query' parameter in the 'CustomerMessage.php' file. Successful exploitation could allow unauthorized access to or manipulation of the underlying database. The vulnerability has been patched in commit 123c97c, available via a GitHub pull request. References include the NVD advisory, CVE record, and a CISA CSAF advisory file. The attack requires authentication with administrative-level access, limiting the attack surface but not eliminating risk in compromised or insider-threat scenarios.
