CVE-2020-7246

This exploit leverages a path traversal vulnerability in qdPM 9.1 to upload a malicious PHP backdoor, enabling remote code execution. It requires authentication and manipulates file upload functionality to bypass restrictions.

This exploit leverages a path traversal vulnerability in qdPM 9.1 to upload a malicious PHP backdoor, enabling remote code execution. It requires authentication and manipulates file upload functionality to bypass restrictions.

This exploit automates the upload of a PHP web shell to qdPM via the 'upload a profile photo' feature, bypassing previous fixes. It establishes a reverse shell by triggering the uploaded payload and includes functionality to remove .htaccess files to ensure execution.

This exploit leverages a path traversal vulnerability in qdPM 9.1 to upload a malicious PHP file, achieving remote code execution. It authenticates with user credentials, manipulates file upload parameters, and places a backdoor in the uploads directory.

This repository provides a Dockerized environment for CVE-2020-7246, a vulnerability in qdPM. It includes a pre-configured lab setup with a vulnerable qdPM instance and references an external Python2 exploit (ExploitDB 47954) for demonstration.

This repository contains a functional exploit for CVE-2020-7246, targeting qdPM 9.1. The exploit leverages a path traversal vulnerability to upload a malicious PHP backdoor, achieving remote code execution (RCE).

This repository contains a functional exploit for CVE-2020-7246, targeting qdPM versions before 9.1. The exploit leverages a file upload vulnerability to achieve remote code execution (RCE) via a PHP reverse shell. The provided Python script automates the login process and payload delivery, while the PHP payload establishes a reverse shell connection.

This Metasploit module exploits an authenticated arbitrary PHP file upload vulnerability in qdPM 9.1 and earlier via path traversal in the profile photo functionality, bypassing .htaccess protection to achieve remote code execution.