CVE-2018-25208

Name of the Vulnerable Software and Affected Versions qdPM version 9.1

Description An SQL injection flaw allows unauthenticated attackers to extract sensitive database information. This is achieved by sending malicious POST requests to the 'timeReport' endpoint using manipulated filter by[CommentCreatedFrom] and filter by[CommentCreatedTo] parameters to execute arbitrary SQL queries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the filter by[CommentCreatedFrom] and filter by[CommentCreatedTo] parameters in the 'timeReport' endpoint until the issue is resolved.