{"uuid": "2fc73719-a8f7-4945-af1d-33a2f030570c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3884", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/qdpm_upload_exec.rb", "content": "{\"aliases\": [], \"arch\": \"php, x86\", \"author\": [\"loneferret\", \"sinn3r \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a vulnerability found in qdPM - a web-based project management\\n          software. The user profile's photo upload feature can be abused to upload any\\n          arbitrary file onto the victim server machine, which allows remote code execution.\\n          Please note in order to use this module, you must have a valid credential to sign\\n          in.\", \"disclosure_date\": \"2012-06-14\", \"fullname\": \"exploit/multi/http/qdpm_upload_exec\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:04 +0000\", \"name\": \"qdPM v7 Arbitrary PHP File Upload Vulnerability\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/multi/http/qdpm_upload_exec.rb\", \"platform\": \"Linux,PHP\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"multi/http/qdpm_upload_exec\", \"references\": [\"CVE-2015-3884\", \"OSVDB-82978\", \"EDB-19154\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Generic (PHP Payload)\", \"Linux x86\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:10.096572Z"}