Which versions of Qdpm are affected by CVE-2018-25208?

qdPM 9.1 contains an unauthenticated SQL injection vulnerability in the timeReport endpoint that allows attackers to extract sensitive database contents including credentials and project data without…

Is there a public PoC exploit available for CVE-2018-25208?

Yes, a public proof-of-concept exploit is available for CVE-2018-25208. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2018-25208?

Within 24 hours: Identify all qdPM 9.1 instances in your environment and immediately restrict network access to the timeReport endpoint via firewall or WAF rules blocking POST requests to /timeReport or equivalent paths. Within 7 days: Evaluate available alternatives (qdPM has ceased active development; consider migrating to actively maintained project management platforms). Within 30 days: Complete migration away from qdPM 9.1 or implement full air-gapping of affected systems from production networks, as no vendor patch exists.

Qdpm CVE-2018-25208

Q: What is the CVSS score of CVE-2018-25208?

CVE-2018-25208 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2018-21675 HIGH

SQL Injection (CWE-89)

2026-03-26 VulnCheck

GHSA-xfmc-rj6p-7fpg

SQLi Information Disclosure Qdpm

8.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 20, 2026 - 14:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 20, 2026 - 14:22 vuln.today

cvss_changed

PoC Detected

Mar 26, 2026 - 15:13 vuln.today

Public exploit code

EUVD ID Assigned

Mar 26, 2026 - 12:00 euvd

EUVD-2018-21675

Analysis Generated

Mar 26, 2026 - 12:00 vuln.today

CVE Published

Mar 26, 2026 - 11:39 nvd

HIGH 8.8

DescriptionCVE.org

qdPM 9.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through filter_by parameters. Attackers can submit malicious POST requests to the timeReport endpoint with crafted filter_by[CommentCreatedFrom] and filter_by[CommentCreatedTo] parameters to execute arbitrary SQL queries and retrieve sensitive data.

AnalysisAI

SQL injection in qdPM 9.1 timeReport endpoint enables remote unauthenticated attackers to extract database contents via crafted filter_by parameters in POST requests. Public exploit code exists (Exploit-DB 45767), and CISA SSVC framework confirms proof-of-concept availability with automatable exploitation. Despite 8.8 CVSS severity, EPSS risk probability remains low at 0.07% (21st percentile), suggesting limited observed exploitation activity. Attackers can retrieve sensitive project management data including credentials, user information, and business records without authentication.

Technical ContextAI

qdPM is an open-source web-based project management tool built on PHP. This vulnerability affects the timeReport module where user-supplied filter_by array parameters (specifically CommentCreatedFrom and CommentCreatedTo fields) are incorporated into SQL queries without proper sanitization or parameterization. The CWE-89 classification indicates classic SQL injection where metacharacters in user input break out of intended query structure, allowing arbitrary SQL command execution. The application likely uses string concatenation to build queries rather than prepared statements with bound parameters. The CVSS vector CVSS:4.0/AV:N/AC:L/PR:N/UI:N indicates network-accessible exploitation with low complexity requiring no privileges or user interaction, while VC:H/VI:L shows high confidentiality impact with limited integrity impact, consistent with data exfiltration capabilities.

RemediationAI

Upgrade qdPM to version 9.2 or later if available, verifying release notes address CVE-2018-25208 at http://qdpm.net. If immediate patching is not feasible, implement compensating controls: deploy web application firewall rules to block POST requests to /timeReport containing special SQL characters (single quotes, semicolons, SQL keywords) in filter_by parameters, recognizing this may break legitimate date filtering functionality requiring UX testing. Restrict network access to qdPM installation using IP allowlisting or VPN requirement, eliminating unauthenticated remote attack vector entirely but impacting remote workforce accessibility. Enable database query logging and configure alerts for suspicious patterns (UNION SELECT, information_schema access, unusual timeReport queries) to detect exploitation attempts, though this provides detection not prevention. Review application logs since deployment for POST requests to timeReport with anomalous filter_by values to identify potential historical compromise. Long-term solution requires code remediation using prepared statements with parameterized queries for all filter_by parameter processing. VulnCheck advisory available at https://www.vulncheck.com/advisories/qdpm-sql-injection-via-filter-by-parameters provides additional technical details.