CVE-2015-3884

CVE-2015-3884 describes an unrestricted file upload vulnerability in qdPM 8.3, specifically within its myAccount, projects, tasks, tickets, discussions, reports, and scheduler pages. This flaw allows authenticated attackers to upload files with executable extensions, such as PHP, and then execute arbitrary code by directly accessing these uploaded files. The vulnerability carries a high CVSS score of 8.8, indicating severe potential impact, including complete compromise of confidentiality, integrity, and availability. Its low attack complexity means it can be exploited remotely without user interaction, and its high EPSS score suggests a significant likelihood of exploitation. While not listed on the CISA KEV catalog, a Metasploit module exists for exploiting this vulnerability, indicating readily available exploit code. Despite this, there is no recorded community discussion or media coverage, suggesting it has not garnered widespread public attention.