Webkul QloApps Cross-Site Request Forgery Vulnerability in Logout Function

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in Webkul QloApps version 1.6.1. The issue arises in the logout function within the URL Handler component, specifically through the '/en/?mylogout' endpoint. This vulnerability allows an attacker to force an authenticated user to log out without their consent, potentially disrupting active sessions and causing issues for users and administrators alike.

Impact

Exploitation of this vulnerability leads to unauthorized logout of users, including administrators, which can disrupt active sessions and site management functions.

Reproduction

To reproduce this vulnerability, log in as a user or administrator on QloApps 1.6.1. Then, visit the '/en/?mylogout' URL. This action will immediately log the user out without any confirmation.