Home

Description

QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attackers to compromise user credentials by exploiting the use of MD5 for password hashing in the Tools::encrypt() function within classes/Tools.php, which concatenates a static cookie key with the supplied password. Attackers can perform offline brute-force attacks against the MD5 hashes, with the risk compounded by auto-generated 8-character passwords assigned during guest-to-customer account conversion in classes/Customer.php, making credential recovery trivial.

PUBLISHED Reserved 2026-02-06 | Published 2026-06-02 | Updated 2026-06-03 | Assigner VulnCheck




HIGH: 8.2CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

MEDIUM: 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Problem types

Use of Password Hash With Insufficient Computational Effort

Product status

Default status
affected

Any version
affected

64e9722e7e6a8fda77dd53964d988fb6b5c3d174 (git)
affected

Credits

Chia Min Jun Lennon finder

VulnCheck finder

References

github.com/Qloapps/QloApps/pull/1689 issue-tracking

github.com/...ommit/64e9722e7e6a8fda77dd53964d988fb6b5c3d174 patch

www.vulncheck.com/...k-password-hashing-via-md5-in-tools-php third-party-advisory

cve.org (CVE-2026-25861)

nvd.nist.gov (CVE-2026-25861)

Download JSON