Information disclosure

Information disclosure issue in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to 1 core/config/databases.yml, 2 core/log/qdPMprod.log, or 3 core/apps/qdPM/config/settings.yml...

Unrestricted file upload

Unrestricted file upload vulnerability in the 1 myAccount, 2 projects, 3 tasks, 4 tickets, 5 discussions, 6 reports, and 7 scheduler pages in qdPM 8.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in qdPM 8.3 allow remote attackers to inject arbitrary web script or HTML via the 1 searchkeywords parameter to index.php/users page; the 2 "Name of application" on index.php/configuration; 3 a new project name on index.php/projects; 4 the task na...

CVE-2015-3881

Information disclosure issue in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to 1 core/config/databases.yml, 2 core/log/qdPMprod.log, or 3 core/apps/qdPM/config/settings.yml...

Design/Logic Flaw

qdPM 8.3 allows remote attackers to obtain sensitive information via invalid ID value to index.php/users/info/id/ID, which reveals the installation path in an error message...

CVE-2015-3884

Unrestricted file upload vulnerability in the 1 myAccount, 2 projects, 3 tasks, 4 tickets, 5 discussions, 6 reports, and 7 scheduler pages in qdPM 8.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the...

CVE-2015-3883

Multiple cross-site scripting XSS vulnerabilities in qdPM 8.3 allow remote attackers to inject arbitrary web script or HTML via the 1 searchkeywords parameter to index.php/users page; the 2 "Name of application" on index.php/configuration; 3 a new project name on index.php/projects; 4 the task na...

CVE-2015-3883

qdPM 8.3 is affected by multiple cross-site scripting (XSS) vulnerabilities. The issues allow remote attackers to inject arbitrary web script or HTML via various user-controlled inputs, including: search[keywords] on index.php/users, the Name of application on index.php/configuration, new project...

CVE-2015-3881

Information disclosure issue in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to 1 core/config/databases.yml, 2 core/log/qdPMprod.log, or 3 core/apps/qdPM/config/settings.yml...

CVE-2015-3882

qdPM 8.3 (Symfony-based PHP/MySQL project management system) is affected by an information-disclosure vulnerability. A remote attacker can send an invalid ID to index.php/users/info/id/[ID] and cause an error message that reveals the installation path. This CVE is documented with CNVD-2017-03454;...

CVE-2015-3882

qdPM 8.3 allows remote attackers to obtain sensitive information via invalid ID value to index.php/users/info/id/ID, which reveals the installation path in an error message...

CVE-2015-3884

qdPM contains an unrestricted file upload vulnerability (affecting 8.3 and earlier) that lets remote attackers upload executable files and access them via uploads/attachments/ or uploads/users/ to achieve RCE. The issue arises from allowing executable extensions and direct file access; Metasploit...

CVE-2015-3881

CVE-2015-3881 affects qdPM 8.3 and is an information disclosure issue. Multiple sources (NVD/CNVD entries) describe that an attacker can obtain sensitive information by forcing or performing a direct request to one of three files: core/config/databases.yml, core/log/qdPM_prod.log, or core/apps/qd...

PT-2017-6703 · Qdpm · Qdpm

Name of the Vulnerable Software and Affected Versions: qdPM version 8.3 Description: The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to various pages in qdPM, including myAccount, projects, tasks, tickets, discussions, reports, and...

qdPM 7 - Arbitrary File upload

No description provided by source. Exploit qdPM v.7 Arbitrary File upload Date: June 13th 2012 Author: loneferret Version: 7 Vendor Url: http://qdpm.net/ Tested on: Winddows XP / XAMPP Discovered by: loneferret Software description: Free project management tool for small team qdPM is a free...

qdPM 7.0 - Arbitrary '.PHP' File Upload (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "qdPM v7 Arbitrary...

qdPM 7 - Arbitrary File upload

qdPM 7 - Arbitrary File upload Exploit qdPM v.7 Arbitrary File upload Date: June 13th 2012 Author: loneferret Version: 7 Vendor Url: http://qdpm.net/ Tested on: Winddows XP / XAMPP Discovered by: loneferret Software description: Free project management tool for small team qdPM is a free web-based...

qdPM 7 - Arbitrary File upload

Exploit qdPM v.7 Arbitrary File upload Date: June 13th 2012 Author: loneferret Version: 7 Vendor Url: http://qdpm.net/ Tested on: Winddows XP / XAMPP Discovered by: loneferret Software description: Free project management tool for small team qdPM is a free web-based project management tool suitab...

qdPM v.7 Arbitrary File upload

Exploit for php platform in category web applications Exploit qdPM v.7 Arbitrary File upload Date: June 13th 2012 Author: loneferret Version: 7 Vendor Url: http://qdpm.net/ Tested on: Winddows XP / XAMPP Discovered by: loneferret Software description: Free project management tool for small team...

qdPM 7 Shell Upload

Exploit qdPM v.7 Arbitrary File upload Date: June 13th 2012 Author: loneferret Version: 7 Vendor Url: http://qdpm.net/ Tested on: Winddows XP / XAMPP Discovered by: loneferret Software description: Free project management tool for small team qdPM is a free web-based project management tool suitab...