Attack Chain

1. The attacker identifies a qdPM 9.1 instance exposed to the internet.
2. The attacker crafts a malicious POST request targeting the /timeReport endpoint.
3. The attacker injects SQL code into the filter_by[CommentCreatedFrom] and filter_by[CommentCreatedTo] parameters within the POST request. The injected SQL code is designed to extract sensitive data.
4. The attacker sends the malicious POST request to the vulnerable qdPM instance.
5. The qdPM application fails to properly sanitize the input provided in the filter_by parameters.
6. The injected SQL code is executed against the qdPM database.
7. The database returns the results of the injected SQL query to the application.
8. The attacker receives the extracted data in the HTTP response, potentially including usernames, passwords, project details, and other sensitive information.

Impact

Successful exploitation of this SQL injection vulnerability allows unauthenticated attackers to extract sensitive information from the qdPM database. This can include usernames, passwords, project details, customer data, and financial information. The impact can range from data breaches and financial losses to reputational damage and legal liabilities. Due to the unauthenticated nature of the vulnerability, all qdPM 9.1 installations exposed to the internet are at risk.

Recommendation

• Apply the necessary patches or upgrade to a secure version of qdPM to remediate CVE-2018-25208.
• Implement input validation and sanitization on all user-supplied data, especially within the filter_by parameters of the timeReport endpoint, to prevent SQL injection attacks.
• Deploy the provided Sigma rule to detect malicious POST requests with SQL injection attempts targeting the timeReport endpoint in your web server logs.
• Monitor web server logs for suspicious activity, such as unusual POST requests to /timeReport with potentially malicious SQL code in the filter_by parameters.