Executive brief
Qualitor is an enterprise workflow and process management system. A code injection vulnerability in its request processing module allows remote attackers to execute arbitrary code by manipulating input parameters, without requiring authentication. An attacker can exploit this to compromise the application server and access sensitive business data or disrupt operations.
Technical details
The vulnerability is a code injection flaw affecting the eval function in /html/st/stdeslocamento/request/getResumo.php. The vulnerable component fails to properly sanitize the "passageiros" parameter before processing it, allowing an attacker to inject arbitrary code. The vulnerability is remotely exploitable without authentication. An attacker can inject malicious code that will be executed on the server with the application's privileges, potentially leading to remote code execution, data theft, or system compromise. Patches are available in versions 8.20.105 and 8.24.98.
Affected products
- Qualitor up to 8.20.104 and 8.24.97
Timeline
- 2025-11-30: disclosed
- 2025-11-30: patched: Versions 8.20.105 and 8.24.98 address this issue