Description
qdPM 9.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through filter_by parameters. Attackers can submit malicious POST requests to the timeReport endpoint with crafted filter_by[CommentCreatedFrom] and filter_by[CommentCreatedTo] parameters to execute arbitrary SQL queries and retrieve sensitive data.
Exploits (1)
References (4)
Core 4
Core References
Third Party Advisory third-party-advisory
VulnCheck Advisory: qdPM 9.1 SQL Injection via filter_by Parameters
https://www.vulncheck.com/advisories/qdpm-sql-injection-via-filter-by-parameters
Scores
CVSS v3
8.2
EPSS
0.0007
EPSS Percentile
20.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-89
Status
published
Products (2)
qdpm/qdpm
< 9.1
Qdpm/qdPM
9.1
Published
Mar 26, 2026
Tracked Since
Mar 26, 2026