PT-2025-47158 · Unknown · Qatraq Version 6.9.2

Published 2025-11-17 · Updated 2025-11-26 · CVE-2025-63748

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QaTraq version 6.9.2

Description QaTraq version 6.9.2 allows authenticated users to upload arbitrary files through the “Add Attachment” feature within the “Test Script” module. The application does not restrict file types, allowing the upload of executable PHP files. Once uploaded, these files can be accessed via the “View Attachment” option, which executes the PHP payload on the server. The vulnerable functionality resides in the “Test Script” module, specifically the file upload process. The Add Attachment feature is susceptible to this issue. The uploaded files are accessible through the View Attachment option.

Recommendations QaTraq version 6.9.2: As a temporary workaround, consider restricting access to the “Test Script” module to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-63748

Affected Products

Qatraq Version 6.9.2

References · 8

• 🔥 https://bitsbyamg.com/blog/post/2025/10/19/qatraq-692-default-creds-and-file-upload-rce · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-63748 · Security Note
• https://osv.dev/vulnerability/CVE-2025-63748 · Vendor Advisory
• https://twitter.com/CVEnew/status/1990462690968445312 · Twitter Post
• https://t.me/CVEtracker/37501 · Telegram Post
• http://qatraq.com · Note
• https://twitter.com/VulmonFeeds/status/1990572431027651065 · Twitter Post
• https://t.me/cveNotify/144107 · Telegram Post