qdPM 9.1 - 'cfg[app_app_name]' Persistent Cross-Site Scripting

Exploit Title: qdPM 9.1 - 'cfgappappname' Persistent Cross-Site Scripting Google Dork: N/A Date: 2020-05-19 Exploit Author: Kishan Lal Choudhary Vendor Homepage: https://qdpm.net Software Link: https://sourceforge.net/projects/qdpm/ Version: 9.1 Tested on: Windows 10 Description: The form paramet...

qdPM 9.1 Arbitrary File Upload

Exploit Title: qdPM 9.1 - Arbitrary File Upload Date: 2020-05-06 Author: Besim ALTINOK Vendor Homepage: https://sourceforge.net/projects/qdpm/ Software Link: https://sourceforge.net/projects/qdpm/ Version: v9.1 Maybe it affect other versions Tested on: Xampp Credit: İsmail BOZKURT Remotely: Yes...

qdPM 9.1 - Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: qdPM 9.1 - Arbitrary File Upload Author: Besim ALTINOK Vendor Homepage: https://sourceforge.net/projects/qdpm/ Software Link: https://sourceforge.net/projects/qdpm/ Version: v9.1 Maybe it affect other versions Tested on: Xampp...

QDPM Command Execution Vulnerability

qdPM is a Web-based open source project management tool . A security vulnerability exists in qdPM version 9.1. An attacker can exploit this vulnerability by uploading a malicious .php file to execute arbitrary commands on the server...

qdPM Injection Vulnerability

qdPM is a Web-based open source project management tool . A security vulnerability exists in qdPM version 9.1. An attacker can exploit the vulnerability to redirect users to a malicious website...

CVE-2020-11811

In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add Profile Photo capability with a crafted content-type value. After that, the attacker can execute an arbitrary command on the server using this malicious file...

CVE-2020-11814

A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular header and redirect users to malicious websites...

CVE-2020-11811

In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add Profile Photo capability with a crafted content-type value. After that, the attacker can execute an arbitrary command on the server using this malicious file...

CVE-2020-11814

A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular header and redirect users to malicious websites...

Design/Logic Flaw

A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular header and redirect users to malicious websites...

CVE-2020-11814

A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular header and redirect users to malicious websites...

CVE-2020-11814

CVE-2020-11814 describes a Host Header Injection in qdPM 9.1 that can allow an attacker to spoof a header and redirect users to malicious sites. Connected sources (Red Hat, CNVD, CVE.org, NVD, PRION, etc.) confirm the issue but do not provide detailed technical exploit steps, affected component g...

CVE-2020-11811

In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add Profile Photo capability with a crafted content-type value. After that, the attacker can execute an arbitrary command on the server using this malicious file...

CVE-2020-11811

The CVE-2020-11811 entry concerns qdPM 9.1 where an attacker can upload a crafted PHP file through the Add Profile Photo capability using a malicious Content-Type, enabling remote code execution on the server via the uploaded file. The vulnerability originates from the server accepting and execut...

qdPM Remote Code Execution (CVE-2020-7246)

A remote code execution vulnerability exists in qdPM. Successful exploitation of this vulnerability could result in execution of arbitrary code on the affected system...

qdPM < 9.1 - Remote Code Execution Exploit

Exploit for multiple platform in category web applications !/usr/bin/python ------------------------------------------------------------------------------------- Title: qdPM Webshell Upload + RCE Exploit qdPMv9.1 and below CVE-2020-7246 Author: Tobin Shields @TobinShields Description: This is an...

qdPM 9.1 - Remote Code Execution

qdPM 9.1 - Remote Code Execution !/usr/bin/python ------------------------------------------------------------------------------------- Title: qdPM Webshell Upload + RCE Exploit qdPMv9.1 and below CVE-2020-7246 Author: Tobin Shields @TobinShields Description: This is an exploit to automatically...

qdPM Remote Code Execution

!/usr/bin/python ------------------------------------------------------------------------------------- Title: qdPM Webshell Upload + RCE Exploit qdPMv9.1 and below CVE-2020-7246 Author: Tobin Shields @TobinShields Description: This is an exploit to automatically upload a PHP web shell to the qdPM...

qdPM &lt; 9.1 - Remote Code Execution

!/usr/bin/python ------------------------------------------------------------------------------------- Title: qdPM Webshell Upload + RCE Exploit qdPMv9.1 and below CVE-2020-7246 Author: Tobin Shields @TobinShields Description: This is an exploit to automatically upload a PHP web shell to the qdPM...

qdPM 9.1 - Remote Code Execution

qdPM 9.1 - Remote Code Execution Exploit Title: qdPM 9.1 - Remote Code Execution Google Dork: intitle:qdPM 9.1. Copyright © 2020 qdpm.net Date: 2020-01-22 Exploit Author: Rishal Dwivedi Loginsoft Vendor Homepage: http://qdpm.net/ Software Link: http://qdpm.net/download-qdpm-free-project-managemen...