CVE-2015-3884
HighSummary
qdPM 8.3 has an unrestricted file upload vulnerability that allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
Risk Assessment
Attackers can exploit this vulnerability to remotely execute code, potentially leading to system compromise and data leakage.
Recommendation
It is recommended to implement restrictions on file uploads and to scan uploaded files for malware.
Other vulnerabilities in qdPM 8.3
See all- CVE-2015-3881High
A vulnerability in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to specific configuration and log files.
- CVE-2019-25669High
qdPM 9.1 is vulnerable to SQL injection via the search_by_extrafields[] parameter. An attacker can manipulate database queries by sending crafted POST requests to the users endpoint, leading to data exfiltration.
Original NVD description (English source)
Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/attachments/ or uploads/users/.