CVE-2017-13068

HIGH

QNAP QTS Helpdesk < 1.1.12 - Unauthenticated SQL Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2017-13068. PoCs published by SecuriTeam.

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in QNAP QTS Helpdesk versions 1.1.12 and earlier, allowing an attacker to extract the password of the _qnap_support user by manipulating the CLI request to SupportUtils.php.

Description

QNAP has already patched this vulnerability. This security concern allows a remote attacker to perform an SQL injection on the application and obtain Helpdesk application information. A remote attacker does not require any privileges to successfully execute this attack.

Exploits (1)

exploitdb WORKING POC
by SecuriTeam · webappsphp
https://www.exploit-db.com/exploits/44060

This exploit demonstrates a SQL injection vulnerability in QNAP QTS Helpdesk versions 1.1.12 and earlier, allowing an attacker to extract the password of the _qnap_support user by manipulating the CLI request to SupportUtils.php.

Classification
Working Poc 100%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: QNAP QTS Helpdesk <= 1.1.12
No auth needed
Prerequisites: Remote Support option enabled on the target system
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

CVSS v3 7.5
EPSS 0.0258
EPSS Percentile 83.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-89
Status published
Products (2)
QNAP/QNAP Helpdesk APP QTS Helpdesk versions 1.1.12 and earlier
qnap/qts_helpdesk < 1.1.12
Published Oct 06, 2017
Tracked Since Feb 18, 2026