loneferret has discovered a vulnerability in qdPM, which can be exploited by malicious users to compromise a vulnerable system.
The vulnerability is caused due to application improperly verifying uploaded files when changing the profile image in myAccount. This can be exploited to execute arbitrary PHP code by uploading a PHP file.
The vulnerability is confirmed in version 7. Other versions may also be affected.
