Vulnerability identifier: #VU47412

Vulnerability risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:U/RC:C]

CVE-ID: CVE-2020-7246

CWE-ID: CWE-22

Exploitation vector: Network

Exploits in database: 7

• September 29, 2022
  • qdPM 9.1 Authenticated Arbitrary PHP File Upload (RCE) [Metasploit]
• August 28, 2022
  • SecAssignment (A Docker image vulnerable to CVE-2020-7246.) [Github]
• May 26, 2022
  • qdPM 9.1 - Remote Code Execution (RCE) (Authenticated) (v2) [Exploit-DB]
• November 25, 2021
  • qdPM 9.1 - Remote Code Execution (RCE) (Authenticated) [Exploit-DB]
• June 17, 2021
  • qdPM 9.1 - Remote Code Execution [Exploit-DB]
  • qdPM < 9.1 - Remote Code Execution [Exploit-DB]
• May 16, 2021
  • qdPM9.1_Exploit (This is an exploit to automatically upload a PHP web shell to the qdPM 9.1 platform via the "upload a profile photo" feature. This method also bypasses the fix put into place from a previous CVE) [Github]

Impact: Information disclosure

Vulnerable software:
qdPM
Web applications / Other software

Vendor: qdpm.net