CVE-2020-7246 — QDPM
HIGHCVE-2020-7246 is a high-severity (CVSS 8.8) Path Traversal vulnerability in qdpm qdpm. 10 public exploit references exist, so weaponization risk is real. No vendor fix is recorded yet; mitigation options are listed below.
A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path…
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2020-7246 by exploitation likelihood (EPSS) against impact (CVSS). In the shaded patch-first corner (EPSS 50%+, CVSS 7.0+).
Where this sits among everything scored
Of 384,993 CVEs with a current EPSS score, this one falls in the 50–90% band (highlighted). Counts from FIRST.org, log-scaled.
Description
A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users['photop_preview'] delete photo feature, allowing bypass of .htaccess protection. NOTE: this issue exists because of an incomplete fix for CVE-2015-3884.
Affected Products
qdpmqdpmResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
qdPM 9.1 - Remote Code Execution (RCE) (Authenticated) (v2)
by RedHatAugust · May 25, 2022
qdPM 9.1 - Remote Code Execution
by Rishal Dwivedi · Jan 23, 2020
qdPM 9.1 - Remote Code Execution (Authenticated)
by Leon Trappett · Aug 4, 2021
qdPM < 9.1 - Remote Code Execution
by Tobin Shields · Feb 28, 2020
Detection & mitigation playbook
Vendor / applianceDetect
Inventory every qdpm qdpm deployment and check each version against the affected-products list above.
Remediation status
No patch has shipped for CVE-2020-7246 yet — track the qdpm qdpm advisory for a fixed release and apply the workarounds below in the meantime.
Mitigate without a patch
Treat uploaded files as untrusted until proven otherwise: validate the actual content type rather than the supplied extension, store uploads outside the web root on a volume mounted without execute permission, and rename them to server-generated identifiers so an attacker cannot choose the path a request will later resolve. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.
Frequently Asked Questions
Is CVE-2020-7246 being exploited in your environment?
Detect and block the exploit chain at execution, on systems you cannot patch yet.