PT-2020-19496 · Qdpm · Qdpm

Published 2020-01-21 · Updated 2022-11-10 · CVE-2020-7246

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions qdPM versions 9.1 and earlier

Description A remote code execution issue exists, allowing an attacker to upload malicious PHP code via the profile photo functionality. This is possible due to a path traversal vulnerability in the users['photop preview'] delete photo feature, which enables bypassing .htaccess protection.

Recommendations For qdPM versions 9.1 and earlier, as a temporary workaround, consider disabling the profile photo upload feature until a patch is available. Restrict access to the users['photop preview'] delete photo feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

RCE

Unrestricted File Upload

Path traversal

Weakness Enumeration

CWE-434

CWE-22

Related Identifiers

CVE-2020-7246

Affected Products

Qdpm

References · 16

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/qdpm_authenticated_rce.rb · Exploit
• 🔥 https://exploit-db.com/exploits/47954 · Exploit
• 🔥 http://packetstormsecurity.com/files/156063/qdPM-9.1-Remote-Code-Execution.html · Exploit
• 🔥 http://packetstormsecurity.com/files/168559/qdPM-9.1-Authenticated-Shell-Upload.html · Exploit
• 🔥 https://docs.google.com/document/d/13ZZSm0DL1Ie6r_fU5ZdDKGZ4defFqiFXMG--zDo8S10/edit?usp=sharing · Exploit
• 🔥 https://exploit-db.com/exploits/50944 · Exploit
• 🔥 http://packetstormsecurity.com/files/167264/qdPM-9.1-Remote-Code-Execution.html · Exploit
• 🔥 http://packetstormsecurity.com/files/156571/qdPM-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/48146 · Exploit
• 🔥 https://exploit-db.com/exploits/50175 · Exploit
• https://osv.dev/vulnerability/CVE-2020-7246 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7246 · Security Note
• https://t.me/defcon_news/40704 · Telegram Post
• https://t.me/cvenotify/31543 · Telegram Post
• https://t.me/cvenotify/369 · Telegram Post