qdPM 9.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through filter_by p…

Published:

25 maart 2026 om 23:00:00

Alert date:

26 maart 2026 om 16:11:28

Source:

nvd.nist.gov

Web Technologies, Enterprise Applications, Database & Storage

CVE-2018-25208 affects qdPM version 9.1, containing an SQL injection vulnerability that allows unauthenticated attackers to extract database information. The vulnerability exists in the filter_by parameters of the timeReport endpoint. Attackers can craft malicious POST requests using filter_by[CommentCreatedFrom] and filter_by[CommentCreatedTo] parameters to execute arbitrary SQL queries. This allows retrieval of sensitive data from the database without authentication. The vulnerability has been documented with public exploits available.

Technical details

Mitigation steps:

Affected products:

qdPM 9.1