CVE-2020-7246 PoC — qdPM 代码问题漏洞

Source

https://github.com/j0hn30n/CVE-2020-7246

Associated Vulnerability

Title: qdPM 代码问题漏洞 (CVE-2020-7246)
Description:A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users['photop_preview'] delete photo feature, allowing bypass of .htaccess protection. NOTE: this issue exists because of an incomplete fix for CVE-2015-3884.

Description

[qdPM < 9.1 - Remote Code Execution](https://www.exploit-db.com/exploits/48146)

Readme

# CVE-2020-7246
[qdPM &lt; 9.1 - Remote Code Execution](https://www.exploit-db.com/exploits/48146)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →