Executive Summary

CVE-2018-25208 is an SQL injection vulnerability found in qdPM version 9.1, a free web-based project management tool. This vulnerability allows unauthenticated attackers to inject malicious SQL code through the filter_by parameters, specifically filter_by[CommentCreatedFrom] and filter_by[CommentCreatedTo], in POST requests to the timeReport endpoint.

By exploiting this flaw, attackers can execute arbitrary SQL queries on the database, enabling them to extract sensitive information. Various SQL injection techniques can be used, including Boolean-based blind SQL Injection, error-based SQL Injection, stacked queries, time-based blind SQL Injection, and UNION-based SQL Injection.

This vulnerability allows attackers to retrieve all database information, potentially compromising the confidentiality and integrity of the application’s data.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts as it allows remote, unauthenticated attackers to extract sensitive data from the qdPM database by executing arbitrary SQL commands.

• Exposure of confidential project management data stored in the database.
• Potential compromise of data integrity due to execution of arbitrary SQL queries.
• Unauthorized access to sensitive information without any authentication.
• Possible further exploitation using advanced SQL injection techniques such as stacked queries and time-based attacks.

Useful 0 Not Useful 0

Detection Guidance

This SQL injection vulnerability in qdPM 9.1 can be detected by sending crafted POST requests to the /index.php/timeReport endpoint with malicious payloads in the filter_by[CommentCreatedFrom] and filter_by[CommentCreatedTo] parameters.

Detection techniques include using Boolean-based blind SQL Injection, error-based SQL Injection, stacked queries, time-based blind SQL Injection, and UNION-based SQL Injection to verify if the application is vulnerable.

Example commands involve sending POST requests with SQL payloads that cause time delays or error messages, such as using the MySQL SLEEP(5) function or EXTRACTVALUE to trigger errors, which indicate vulnerability.

• Send a POST request to /index.php/timeReport with filter_by[CommentCreatedFrom]=1' OR SLEEP(5)-- and filter_by[CommentCreatedTo]=1 to test for time-based blind SQL Injection.
• Use error-based payloads like filter_by[CommentCreatedFrom]=1' AND EXTRACTVALUE(1, CONCAT(0x7e, (SELECT database()), 0x7e))-- to trigger database error messages revealing information.
• Attempt UNION-based SQL Injection by injecting payloads that combine SELECT statements to retrieve database data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting or filtering input to the filter_by parameters to prevent SQL injection.

Apply input validation and use parameterized queries or prepared statements in the application code to avoid direct injection of SQL commands.

If possible, update qdPM to a version later than 9.1 where this vulnerability is fixed or apply any available patches from the vendor.

Additionally, monitor and block suspicious POST requests to the /index.php/timeReport endpoint that contain unusual or malicious payloads in the filter_by parameters.

Useful 0 Not Useful 0

Compliance Impact

The SQL injection vulnerability in qdPM 9.1 allows unauthenticated attackers to extract sensitive database information by injecting malicious SQL code. This unauthorized access to sensitive data can lead to violations of data protection regulations such as GDPR and HIPAA, which require the protection of personal and sensitive information from unauthorized access and breaches.

Because attackers can retrieve sensitive data from the database without authentication, organizations using vulnerable versions of qdPM may face compliance risks related to confidentiality, data integrity, and privacy requirements mandated by these standards.

Useful 0 Not Useful 0