CVE-2019-25669 - Vulnerability Analysis

Overview

qdPM 9.1 contains an sql injection caused by unsanitized input in the search_by_extrafields[] parameter in the users endpoint, letting attackers manipulate database queries and extract information, exploit requires crafted POST requests.

Severity & Score

Impact

Attackers can manipulate database queries to extract sensitive information or cause errors.

Mitigation

Update to the latest version.

References

• http://qdpm.net
• http://qdpm.net/download-qdpm-free-project-management
• https://www.exploit-db.com/exploits/46387
• https://www.vulncheck.com/advisories/qdpm-sql-injection-via-search-by-extrafields-parameter

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner