An unauthenticated SQL injection vulnerability in qdPM 9.1 allows remote attackers to execute arbitrary database queries and retrieve sensitive information.

The application is susceptible to SQL injection (CWE-89) because it fails to properly sanitize user-supplied input in the filter_by parameter. An unauthenticated attacker can submit malicious POST requests to the timeReport endpoint to execute unauthorized SQL queries.

Successful exploitation allows an attacker to bypass authentication controls and gain unauthorized access to the underlying database. This can lead to the full exposure of project management data, user credentials, and sensitive business information, causing severe reputational damage and potential loss of intellectual property. The CVSS score of 8.2 reflects the high severity of this flaw, as it allows for significant data exfiltration without requiring any prior user account access.

Immediate Action: As no official patch is available for this legacy version, administrators should immediately restrict access to the affected web application or migrate to a secure alternative.

Proactive Monitoring: Review web server access logs for suspicious POST requests directed at the timeReport endpoint containing SQL syntax characters like quotes, semicolons, or common SQL keywords.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting the filter_by parameter in POST requests.

Public Exploit Available: Yes, a functional exploit is available via the Exploit-DB entry 45767.

The presence of a publicly available exploit for this unauthenticated SQL injection vulnerability poses a significant risk to any organization running qdPM 9.1. Given the lack of a vendor-supplied patch, immediate action is required to isolate the application or implement strict network-level controls. Security teams must prioritize decommissioning or protecting this instance to prevent potential data breaches.