CVE-2019-25669
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
qdPM 9.1 is vulnerable to SQL injection via the search_by_extrafields[] parameter. An attacker can manipulate database queries by sending crafted POST requests to the users endpoint, leading to data exfiltration.
Risk Assessment
An attacker can gain unauthorized access to the database, steal sensitive information, and potentially take control of the application.
Recommendation
Update qdPM to a patched version. Implement parameterized SQL queries and input validation.
Other vulnerabilities in qdPM
See all- CVE-2015-3884High
qdPM 8.3 has an unrestricted file upload vulnerability that allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
- CVE-2015-3881High
A vulnerability in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to specific configuration and log files.
Original NVD description (English source)
qdPM 9.1 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the search_by_extrafields[] parameter. Attackers can send POST requests to the users endpoint with malicious search_by_extrafields[] values to trigger SQL syntax errors and extract database information.