CVE-2023-45855

HIGHNuclei

qdPM 9.2 - Directory Traversal

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2023-45855 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.

Description

qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 17, 2024 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryHIGHqdPM 9.2 - Directory TraversalCVSS 7.5

qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI.

Impact

Successful exploitation could allow an attacker to read sensitive files on the server.

Remediation

Upgrade qdPM to a non-vulnerable version to mitigate the directory traversal vulnerability.

WeaknessesCWE-22
AuthorsDhiyaneshDk
Template tagscvecve2023qdpmlfivuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:qdpm:qdpm:9.2:*:*:*:*:*:*:*
Shodan: http.favicon.hash:762074255
FOFA: icon_hash=762074255
https://github.com/SunshineOtaku/Report-CVE/blob/main/qdPM/9.2/Directory%20Traversal.md https://nvd.nist.gov/vuln/detail/CVE-2023-45855 https://qdpm.net/

Source: ProjectDiscovery

References

3