CVE-2023-45855 Scanner

qdPM is a project management software used by teams and organizations for tracking time, managing tasks, and collaborating on projects. It is utilized by small and medium enterprises worldwide that need a flexible solution for managing their projects efficiently. Project managers and teams use qdPM to keep track of progress and milestones. It is known for being feature-rich and easy to customize, meeting a wide range of project management needs. The software supports multiple workflows, enabling teams to tailor their processes effectively. With its open-source nature, qdPM allows users to contribute and modify its functionality to suit specific requirements.

The Directory Traversal vulnerability in qdPM allows attackers to access restricted directories and potentially sensitive files on the server. It exploits inadequately secured paths, enabling unauthorized users to traverse directories outside the web server's root directory. The vulnerability poses a significant threat as it grants attackers access to view or download files that contain sensitive or confidential information. This type of vulnerability can lead to unauthorized data exposure, especially when files such as passwords, system configurations, or other critical documents are accessed. Security flaws like this underline the importance of proper input validation and permission management in web applications.

Technically, the Directory Traversal vulnerability in qdPM version 9.2 is based on improper handling of file path inputs, specifically when accessing the /uploads URI endpoint. Attackers can exploit this by manipulating URL paths to gain access to directories and files not intended for public exposure. The use of relative file paths (like "../../../") allows attackers to navigate to directories outside the intended access scope, revealing the content of sensitive directories. It's important to sanitize inputs appropriately and ensure the web application's path resolving mechanism does not allow such directory navigation beyond what is designated.

Exploitation of this vulnerability can lead to unauthorized file reading, potentially exposing confidential documents, application source code, configuration files, or database contents. This type of unauthorized access may facilitate further attacks, increasing the risk of data breaches or other security incidents. Sensitive information obtained can be used for malicious purposes, such as identity theft, fraud, or sabotage. Organizations may also experience reputational damage as a result of successful exploits of this kind.

REFERENCES

• https://github.com/SunshineOtaku/Report-CVE/blob/main/qdPM/9.2/Directory%20Traversal.md
• https://nvd.nist.gov/vuln/detail/CVE-2023-45855
• https://qdpm.net