RCE in Qualitor processVariavel.php via gridValoresPopHidden

Successful exploitation allows a remote attacker to execute arbitrary code in the context of the vulnerable Qualitor application. This can lead to full compromise of the application instance, unauthorized access to sensitive data, modification of application behavior, deployment of web shells or other malware, and potentially further lateral movement depending on the privileges of the web server and host environment.

If an immediate patch is not available, restrict access to the affected Qualitor instance and, where possible, block or monitor requests to html/ad/adpesquisasql/request/processVariavel.php, especially those supplying the gridValoresPopHidden parameter. Deploy WAF rules or reverse-proxy filtering to detect and block PHP code injection attempts, reduce exposure of the application to untrusted networks, and harden the PHP environment to limit post-exploitation impact. Increased logging and monitoring for suspicious requests and unexpected server-side command or script execution are also advisable.

Upgrade Qualitor to a version newer than 8.20 if a vendor-fixed release is available. The vulnerable code path in html/ad/adpesquisasql/request/processVariavel.php should be corrected so that user-controlled input from gridValoresPopHidden is never interpreted or executed as PHP code. Apply strict server-side input validation, remove any dynamic code evaluation behavior, and review similar request handlers for equivalent code injection patterns.