CVE-2020-7246

HIGH

qdPM 9.1 - Remote Code Execution

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2020-7246 has a selected CVSS score of 8.8 (high); EIP currently links 5 catalogued exploits, 2 repository PoCs, and 1 lab environment.

Description

A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users['photop_preview'] delete photo feature, allowing bypass of .htaccess protection. NOTE: this issue exists because of an incomplete fix for CVE-2015-3884.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
5
Repository PoCs
2
Lab environments
1

Proofs of concept

7

Catalogued exploits

ExploitDBqdPM 9.1 - Remote Code ExecutionExploitDB exploitby Rishal DwivediNot analyzed1 file
ExploitDB
PoC details
ExploitDBqdPM < 9.1 - Remote Code ExecutionExploitDB exploitby Tobin ShieldsNot analyzed1 file
ExploitDB
PoC details
ExploitDBqdPM 9.1 - Remote Code Execution (Authenticated)ExploitDB exploitby Leon TrappettNot analyzed1 file
ExploitDB
PoC details
ExploitDBqdPM 9.1 - Remote Code Execution (RCE) (Authenticated) (v2)ExploitDB exploitby RedHatAugustNot analyzed1 file
ExploitDB
PoC details
MetasploitqdPM 9.1 Authenticated Arbitrary PHP File Upload (RCE)Metasploit exploitby Giacomo Casoni +2 moreNot analyzed1 file

Ruby

Metasploit
PoC details

Repository PoCs

GitHubj0hn30n/CVE-2020-7246Repository PoCby j0hn30n0Not analyzed3 files

11.8 KiB

GitHub
PoC details
GitHubarafatansari/SecAssignmentRepository PoCby arafatansari0Not analyzed4 files

70.1 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

Repository root

arafatansari/SecAssignmentCreated Vuln labCVE-2020-7246Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single Dockerfile based on arafatansari/cveine:20207246, with a README describing a vulnerability lab for CVE-2020-7246 in qdPM 9.1, and an exploit script that performs path traversal and remote code execution.

Dockerfile:1-4README.md:1-25

Lab assessment

Vulnerability lab

The README explicitly states 'For educational purposes only' and provides steps to build, run, and exploit a qdPM instance vulnerable to CVE-2020-7246. The included exploit script targets the described vulnerability.

README.md:1-25
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

base image declarationservice startupport exposure

Uses arafatansari/cveine:20207246 as base image, attempts to start apache2 and mysql services, and exposes port 80.

Dockerfile:1-4

exploit.py

exploit script

Python script that logs into a qdPM instance, exploits a path traversal vulnerability to upload a backdoor PHP file, and reports the backdoor URL.

Exploit/exploit.py:1-92

README.md

documentation

Provides build, run, exploit, and verification instructions for the CVE-2020-7246 lab.

README.md:1-25
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2020-7246

Supported by supplied evidence

The README explicitly associates the lab with CVE-2020-7246, and the exploit script implements a path traversal and remote code execution attack consistent with the CVE description.

README.md:1Exploit/exploit.py:1-92
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the container.README.md:8-12
  • The target qdPM instance must be accessible at the provided URL.README.md:16
  • Valid user credentials (email and password) for the qdPM instance are required.README.md:16

Evidence-described exercise path

  1. Clone the repository and build the Docker image.README.md:8-10
  2. Run the container with port mapping and start services.README.md:11-12
  3. Execute the exploit script against the target qdPM instance.README.md:16
  4. Verify exploitation by accessing the uploaded backdoor.README.md:20
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The exploit script targets the lab's own qdPM instance and uploads a backdoor as part of the vulnerability demonstration. No evidence of host escape, external connectivity, persistence, credential theft, or destructive behavior beyond the intended lab target.

Exploit/exploit.py:1-92README.md:1-25
Review boundaries

What the analysis did not establish

  • The base image arafatansari/cveine:20207246 is not inspected; its contents and behavior are unknown.
  • The Dockerfile uses RUN service apache2 start | service mysql start, which is not a valid way to start services in a container; the actual runtime behavior may differ.
  • The exploit script is provided as-is; its exact behavior depends on the target environment and may have unintended effects if used outside the lab.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

6