Published: 17/03/2017 Updated: 27/01/2023

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 690

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote malicious users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/attachments/ or uploads/users/.

Vulnerable Product	Search on Vulmon	Subscribe to Product
qdpm qdpm

A remote code execution vulnerability exists in qdPM versions 91 and below An attacker can upload a malicious PHP code file via the profile photo functionality by leveraging a path traversal vulnerability in the users['photop_preview'] delete photo feature thus allowing bypass of htaccess protection NOTE: this issue exists because of an incompl ...

A remote code execution (RCE) vulnerability exists in qdPM 91 and earlier An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users['photop_preview'] delete photo feature, allowing bypass of htaccess protection NOTE: this issue ex ...

A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users['photop_preview'] delete photo feature, allowing bypass of .htaccess protection. NOTE: this issue exists because of an incomplete fix for CVE-2015-3884.

msf > use exploit/multi/http/qdpm_authenticated_rce
msf exploit(qdpm_authenticated_rce) > show targets
    ...targets...
msf exploit(qdpm_authenticated_rce) > set TARGET < target-id >
msf exploit(qdpm_authenticated_rce) > show options
    ...show and set options...
msf exploit(qdpm_authenticated_rce) > exploit

This is an exploit to automatically upload a PHP web shell to the qdPM 9.1 platform via the "upload a profile photo" feature. This method also bypasses the fix put into place from a previous CVE

qdPM v91 Authenticated RCE Exploit This is an exploit to automatically upload a PHP web shell to the qdPM 91 platform via the "upload a profile photo" feature This method also bypasses the fix put into place from a previous CVE Vulnerability Information CVE: CVE-2020-7246 NVD Published Date: 01/21/2020 Base Score 88 (HIGH) Vulnerability Type Web Exploit

CWE-434 http://rossmarks.uk/whitepapers/qdPM_8.3.txt http://rossmarks.uk/portfolio.php http://packetstormsecurity.com/files/168559/qdPM-9.1-Authenticated-Shell-Upload.html https://nvd.nist.gov https://github.com/TobinShields/qdPM9.1_Exploit https://packetstormsecurity.com/files/168559/qdPM-9.1-Authenticated-Shell-Upload.html

CVE-2015-3884

Vulnerability Summary

Vulnerability Trend

Exploits

Metasploit Modules

Github Repositories

References

Vulmon Search

About

Products

Connect