Hello,
We came across the following link pretending a RCE exists in ProjeQtOr :
https://packetstormsecurity [.]com/files/171950/ppms1032-shell.txt
Can you guys check if this claim is legit ?
Sorry if this is not the right place to ask 
Hi,
This may be a vulnerability only if :
- your web server (apache) is configured to execute .phar files as script code (like .php)
- you did not follow hints to store attachements out out web reach
NB : we will never forbid to upload scripting files, such as .phar, .sh or else as this may be patch of a bug description.
Projeqtor is coded so that uploaded file cannot be executed from a web page.
Anyway, we'll have a fix on next patch
We saw a similar claim for DotClear (by the same author) and they chose to forbid phar files : https://github [.]com/dotclear/dotclear/commit/868e74d80b185290964dcedf227f57b1ad42696d
But yeah, ProjeQtOr is a totally different product.
Anyway, thank you very much for the quick answer