CVE-2020-24912
MediumCVSS 6.1Exploitation Probability (EPSS)
Very high risk93th percentile - higher than 93% of all known CVEs
Summary
A reflected cross-site scripting (XSS) vulnerability exists in qcubed (all versions including 3.1.1) in profile.php via the stQuery parameter. It allows unauthenticated attackers to steal sessions of authenticated users.
Risk Assessment
An attacker can hijack the session of an administrator or other logged-in user, gaining full access to the system and data.
Recommendation
Immediately update qcubed to a patched version or apply a workaround by validating and sanitizing the stQuery parameter in profile.php.
Other vulnerabilities in qcubed
See all- CVE-2020-24914Critical
A PHP object injection vulnerability in profile.php of qcubed (all versions including 3.1.1) unserializes untrusted data from the POST variable "strProfileData", allowing an unauthenticated attacker to execute arbitrary code via a crafted POST request.
- CVE-2020-24913Critical
A SQL injection vulnerability in qcubed (all versions up to 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.
Original NVD description (English source)
A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.