CVE-2020-24913
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
A SQL injection vulnerability in qcubed (all versions up to 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.
Risk Assessment
An attacker can read, modify, or delete database data, leading to a breach of confidentiality, integrity, and availability of the organization's data.
Recommendation
Immediately update qcubed to the latest patched version or apply a temporary fix such as validating and sanitizing the strQuery parameter.
Other vulnerabilities in qcubed
See all- CVE-2020-24914Critical
A PHP object injection vulnerability in profile.php of qcubed (all versions including 3.1.1) unserializes untrusted data from the POST variable "strProfileData", allowing an unauthenticated attacker to execute arbitrary code via a crafted POST request.
- CVE-2020-24912Medium
A reflected cross-site scripting (XSS) vulnerability exists in qcubed (all versions including 3.1.1) in profile.php via the stQuery parameter. It allows unauthenticated attackers to steal sessions of authenticated users.
Original NVD description (English source)
A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.