qdPM 9.1 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the search_by_extrafields[] …

Published:

4 april 2026 om 22:00:00

Alert date:

5 april 2026 om 22:09:04

Source:

nvd.nist.gov

Web Technologies, Database & Storage

qdPM version 9.1 contains a SQL injection vulnerability in the search_by_extrafields[] parameter that allows attackers to manipulate database queries. Attackers can exploit this by sending malicious POST requests to the users endpoint, potentially triggering SQL syntax errors and extracting sensitive database information. The vulnerability affects the search functionality and can lead to unauthorized database access.

Technical details

Mitigation steps:

Affected products:

qdPM 9.1