CVE-2023-45856 File upload in n/a

Critical 9.8 Published 14 Oct 2023 Updated 17 Sep 2024

Attackers can achieve remote code execution by uploading malicious PHP files via the project attachment feature in qdPM.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-45856?

CVE-2023-45856 is a critical vulnerability in n/a, published on 14 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

qdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit Project to upload a .php file to the /uploads URI.

Weakness: CWE-434

Which versions are affected by CVE-2023-45856?

It affects 1 product.

Products include Qdpm Qdpm.

How do I fix CVE-2023-45856?

No fix has been published for CVE-2023-45856 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-45856 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-45856 exists.

Sources

Also known as GHSA-5mmq-8hjw-gc3g.