CVE-2020-7246

Description

A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users['photop_preview'] delete photo feature, allowing bypass of .htaccess protection. NOTE: this issue exists because of an incomplete fix for CVE-2015-3884.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

qdPM 9.1 Authenticated Arbitrary PHP File Upload (RCE)
exploit/multi/http/qdpm_authenticated_rce

Exploit-DB 4

qdPM 9.1 - Remote Code Execution (RCE) (Authenticated) (v2) EDB-50944 · webapps · May 25, 2022 · verified
qdPM 9.1 - Remote Code Execution (Authenticated) EDB-50175 · webapps · Aug 4, 2021 · verified
qdPM < 9.1 - Remote Code Execution EDB-48146 · webapps · Feb 28, 2020
qdPM 9.1 - Remote Code Execution EDB-47954 · webapps · Jan 23, 2020

GitHub 3 repositories

pswalia2u/CVE-2020-7246 ★ 1 · Sep 16, 2022
arafatansari/SecAssignment ★ 0 · Aug 27, 2022

A Docker image vulnerable to CVE-2020-7246.
j0hn30n/CVE-2020-7246 ★ 0 · Dec 5, 2020

[qdPM < 9.1 - Remote Code Execution](https://www.exploit-db.com/exploits/48146)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profil…