Vulnerability in N/a
CVE-2020-7246
A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users['photop_preview'] d…
EPSS: 0.904 (99.6th percentile) — read the EPSS interpretation.
Affected products
- N/a — versions n/a
Public proof-of-concept exploits
References
- docs.google.com/document/d/13ZZSm0DL1Ie6r_fU5ZdDKGZ4defFqiFXMG--zDo8S10/edit (x_refsource_MISC)
- packetstormsecurity.com/files/156063/qdPM-9.1-Remote-Code-Execution.html (x_refsource_MISC)
- packetstormsecurity.com/files/156571/qdPM-Remote-Code-Execution.html (x_refsource_MISC)
- packetstormsecurity.com/files/167264/qdPM-9.1-Remote-Code-Execution.html (x_refsource_MISC)
- packetstormsecurity.com/files/168559/qdPM-9.1-Authenticated-Shell-Upload.html (x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-7246?
- CVE-2020-7246 is a vulnerability in N/a. Published 2020-01-21.
- Is CVE-2020-7246 known to be exploited?
- 48 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.