CVE-2020-24913

CriticalCVSS 9.8

Published: 04/03/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

40.62%

98th percentile - higher than 98% of all known CVEs

Summary

A SQL injection vulnerability in qcubed (all versions up to 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.

Risk Assessment

An attacker can read, modify, or delete database data, leading to a breach of confidentiality, integrity, and availability of the organization's data.

Recommendation

Immediately update qcubed to the latest patched version or apply a temporary fix such as validating and sanitizing the strQuery parameter.

Original NVD description (English source)

A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.