Design/Logic Flaw

In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add Profile Photo capability with a crafted content-type value. After that, the attacker can execute an arbitrary command on the server using this malicious file...

CVE-2020-11811

In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add Profile Photo capability with a crafted content-type value. After that, the attacker can execute an arbitrary command on the server using this malicious file...

CVE-2020-11811: Unrestricted Upload of File with Dangerous Type

In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add Profile Photo capability with a crafted content-type value. After that, the attacker can execute an arbitrary command on the server using this malicious file...

PT-2020-4302

Name of the Vulnerable Software and Affected Versions: qdPM version 9.1 Description: The issue is related to unrestricted file upload in qdPM, allowing an attacker to upload a malicious .php file to the server. This can be achieved by exploiting the Add Profile Photo capability with a crafted...