CVE-2015-3884

Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/attachments/ or uploads/users/.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

14.40% chance of exploitation in the next 30 days, 96th percentile

Published

2017-03-17

Updated

2024-08-06

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/168559/qdPM-9.1-Authenticated-Shell-Upload.html
• TobinShields/qdPM9.1_Exploit4★ · 2020-02-28

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/qdpm_upload_exec.rb

References

• CVE Record
• NVD entry

Related

• CVE-2020-7246
• CVE-2015-3864
• CVE-2015-3888
• CVE-2015-3840
• CVE-2015-3897
• CVE-2015-3839