qdPM 9.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through filter_by parameters. Attackers can submit malicious POST requests to the timeReport endpoint with crafted filter_by[CommentCreatedFrom] and filter_by[CommentCreatedTo] parameters to execute arbitrary SQL queries and retrieve sensitive data.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Qdpm
  • Qdpm

No data.

No data.

References
Link Providers
https://www.spirityenterprise.com/pentest spirity
https://www.spirityenterprise.com/mdr-for-endpoint spirity
http://qdpm.net cve-icon cve-icon
http://qdpm.net/download-qdpm-free-project-management cve-icon cve-icon
https://www.exploit-db.com/exploits/45767 cve-icon cve-icon
https://www.vulncheck.com/advisories/qdpm-sql-injection-via-filter-by-parameters cve-icon cve-icon
History

Thu, 26 Mar 2026 12:00:00 +0000

Type Values Removed Values Added
Description qdPM 9.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through filter_by parameters. Attackers can submit malicious POST requests to the timeReport endpoint with crafted filter_by[CommentCreatedFrom] and filter_by[CommentCreatedTo] parameters to execute arbitrary SQL queries and retrieve sensitive data.
Title qdPM 9.1 SQL Injection via filter_by Parameters
First Time appeared Qdpm
Qdpm qdpm
Weaknesses CWE-89
CPEs cpe:2.3:a:qdpm:qdpm:8.3:*:*:*:*:*:*:*
cpe:2.3:a:qdpm:qdpm:9.0:*:*:*:*:*:*:*
cpe:2.3:a:qdpm:qdpm:9.1:*:*:*:*:*:*:*
cpe:2.3:a:qdpm:qdpm:9.2:*:*:*:*:*:*:*
Vendors & Products Qdpm
Qdpm qdpm
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}

cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-03-26T18:35:47.179Z

Reserved: 2026-03-26T11:34:36.724Z

Link: CVE-2018-25208

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-26T12:16:06.047

Modified: 2026-03-26T15:13:15.790

Link: CVE-2018-25208

cve-icon Redhat

No data.