qdPM SQL Injection Vulnerability in Users Endpoint

A SQL injection vulnerability has been identified in qdPM version 9.1. This vulnerability allows attackers to inject SQL code through the 'search_by_extrafields[]' parameter in POST requests to the users endpoint. Exploitation of this vulnerability can trigger SQL syntax errors and potentially allow for extraction of database information.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate database queries. This could lead to unauthorized data access or modification.

Reproduction

To reproduce this vulnerability, send a POST request to the 'qdpm/index.php/users' endpoint. Include the 'search_by_extrafields[]' parameter with a value that will trigger a SQL syntax error. The response should indicate a SQL syntax error, confirming the injection was successful.