CVE-2020-26165
📋 TL;DR
CVE-2020-26165 is a PHP object injection vulnerability in qdPM project management software that allows attackers to execute arbitrary code by exploiting insecure deserialization in the timeReportActions::executeExport function. This affects all qdPM installations through version 9.1. Attackers can achieve remote code execution if they can reach the vulnerable endpoint.
💻 Affected Systems
- qdPM
📦 What is this software?
Qdpm by Qdpm
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Remote code execution allowing attackers to install backdoors, steal sensitive project data, and pivot to other systems.
If Mitigated
Limited impact if proper network segmentation and web application firewalls block malicious payloads.
🎯 Exploit Status
Public exploit code exists and requires no authentication. Attackers only need network access to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 9.1
Vendor Advisory: http://qdpm.net/qdpm-release-notes-free-project-management
Restart Required: No
Instructions:
1. Upgrade qdPM to version after 9.1. 2. Replace the vulnerable actions.class.php file with patched version. 3. Clear any cached PHP files.
🔧 Temporary Workarounds
Disable timeReport module
linuxTemporarily disable the vulnerable timeReport module to prevent exploitation
mv core/apps/qdPM/modules/timeReport core/apps/qdPM/modules/timeReport.disabled
WAF rule for PHP object injection
allImplement web application firewall rules to block PHP serialized object payloads
🧯 If You Can't Patch
- Network segmentation to isolate qdPM from critical systems
- Implement strict input validation and sanitization for all user inputs
🔍 How to Verify
Check if Vulnerable:
Check if qdPM version is 9.1 or earlier and if core/apps/qdPM/modules/timeReport/actions/actions.class.php contains unserialize() calls without proper validation.Check Version:
grep -r 'qdPM version' ./* 2>/dev/null || check qdPM admin panelVerify Fix Applied:
Verify that the actions.class.php file no longer contains insecure unserialize() calls or has proper input validation.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /index.php/timeReport/export
- PHP errors containing unserialize() failures
- Large serialized data in web logs
Network Indicators:
- HTTP POST requests with serialized PHP objects in parameters
- Traffic to known exploit paths
SIEM Query:
web.url:*timeReport* AND (web.method:POST OR web.post_data:*O:* OR web.post_data:*C:* OR web.post_data:*a:*s:*)🔗 References
- http://packetstormsecurity.com/files/160733/qdPM-9.1-PHP-Object-Injection.html
- http://qdpm.net/qdpm-release-notes-free-project-management
- http://seclists.org/fulldisclosure/2021/Jan/10
- http://packetstormsecurity.com/files/160733/qdPM-9.1-PHP-Object-Injection.html
- http://qdpm.net/qdpm-release-notes-free-project-management
- http://seclists.org/fulldisclosure/2021/Jan/10
