An unauthenticated SQL injection vulnerability in qdPM 9.1 allows remote attackers to compromise database integrity and confidentiality.

This is an SQL injection vulnerability (CWE-89) triggered by the search_by_extrafields[] parameter. An unauthenticated attacker can send malicious POST requests to the users endpoint to manipulate backend database queries.

The ability for an unauthenticated user to inject arbitrary SQL commands represents a critical security risk. Successful exploitation can lead to unauthorized data exfiltration, potential modification of project management records, and loss of database confidentiality. Given the CVSS score of 8.2, the impact on organizational data integrity is severe.

Immediate Action: As no official patch is currently identified, users should restrict access to the affected web application endpoints using network-level controls or by disabling the vulnerable search functionality if it is not business-critical.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at the /users endpoint, specifically looking for URL-encoded characters or SQL syntax patterns within the search_by_extrafields[] parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, specifically targeting the identified parameter.

Public Exploit Available: Yes — a published proof-of-concept exists as documented on Exploit-DB (EDB-ID: 46387).

The presence of a public proof-of-concept combined with the unauthenticated nature of this vulnerability necessitates immediate attention. Organizations utilizing qdPM 9.1 must prioritize implementing compensating controls or migrating to a supported version, as the lack of an official patch leaves the application exposed to trivial exploitation attempts.