qdPM 9.1, a project management solution, contains a critical SQL injection flaw in its timeReport endpoint. By submitting specially crafted POST requests with malicious input in the filter_by[CommentCreatedFrom] and filter_by[CommentCreatedTo] parameters, an attacker can inject arbitrary SQL code. This flaw allows unauthenticated users to read sensitive database records, potentially exposing confidential information. The weakness is a classic SQL injection (CWE-89).

Qdpm product, specifically versions 8.3, 9.0, 9.1, and 9.2. The product is commonly deployed by organizations relying on qdPM for project management tasks; any installation using these versions is potentially exposed if the timeReport endpoint is reachable from untrusted networks.

The CVSS base score is 8.8, indicating a high severity risk. No EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely without authentication by sending POST requests to the timeReport URL from any external origin. Given the lack of authentication checks and the direct influence over SQL query formation, exploitation is straightforward for an adversary with network access to the application.