CVE-2025-63747
📋 TL;DR
QaTraq 6.9.2 ships with default administrative credentials that are enabled in fresh installations. This allows attackers who can access the login page to immediately gain administrative privileges. All organizations running QaTraq 6.9.2 with default settings are affected.
💻 Affected Systems
- QaTraq
📦 What is this software?
Qatraq by Testmanagement
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with administrative access leading to data theft, ransomware deployment, or complete system takeover.
Likely Case
Attackers gain administrative control, modify configurations, access sensitive data, and potentially execute remote code via file upload functionality.
If Mitigated
Limited to unauthorized administrative access without ability to escalate further or access critical systems.
🎯 Exploit Status
Exploitation requires only knowledge of default credentials and access to the login page. The referenced blog post demonstrates file upload RCE after authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://qatraq.com
Restart Required: No
Instructions:
1. Change default administrative credentials immediately. 2. Disable or delete the default administrative account if not needed. 3. Monitor vendor website for security updates.
🔧 Temporary Workarounds
Change Default Credentials
allImmediately change the default administrative password to a strong, unique password.
Use QaTraq administrative interface to change password
Network Access Control
allRestrict access to QaTraq login page to authorized IP addresses only.
Configure firewall rules to limit access to QaTraq port
🧯 If You Can't Patch
- Isolate QaTraq system on separate network segment with strict access controls
- Implement multi-factor authentication if supported, or use VPN with strong authentication for access
🔍 How to Verify
Check if Vulnerable:
Attempt to log into QaTraq web interface using default administrative credentials (check vendor documentation for defaults).Check Version:
Check QaTraq web interface footer or about page for version informationVerify Fix Applied:
Verify default credentials no longer work and only authorized accounts can access administrative functions.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts followed by successful login with default credentials
- Administrative actions from unexpected IP addresses
Network Indicators:
- Unusual traffic patterns to QaTraq login page from external sources
SIEM Query:
source="qatraq" AND (event="login_success" AND user="admin") OR (event="file_upload" AND user="admin")