Executive brief
qdPM is a web-based project management tool used by teams to track tasks, projects, and customer support tickets. A security flaw in its search functionality allows an unauthorized attacker to interfere with the application's database. This could lead to the exposure of sensitive project data, user information, or internal database structures, potentially disrupting business operations and compromising confidentiality.
Technical details
An SQL injection vulnerability exists in qdPM version 9.1 and potentially earlier versions due to improper neutralization of special elements in the 'search_by_extrafields[]' parameter. The flaw is located within the users endpoint (/index.php/users) and can be triggered via a specially crafted POST request. An unauthenticated remote attacker can inject malicious SQL code to cause syntax errors or perform boolean-based/error-based data extraction. This allows for the unauthorized retrieval of database content, including user credentials and project details. While the advisory focuses on version 9.1, the vendor has since released version 9.3, which may address these issues.
Affected products
- qdPM qdPM 9.1 and earlier
Timeline
- 2019-02-14: disclosed: Initial discovery and proof-of-concept published on Exploit-DB
- 2023-01-08: patched: Version 9.3 released (though advisory specifically targets 9.1)
- 2026-04-05: advisory: CVE-2019-25669 published via NVD/VulnCheck