CVE-2020-24913
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
A SQL injection vulnerability in qcubed (all versions up to 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.
Risk Assessment
An attacker can read, modify, or delete database data, leading to a breach of confidentiality, integrity, and availability of the organization's data.
Recommendation
Immediately update qcubed to the latest patched version or apply a temporary fix such as validating and sanitizing the strQuery parameter.
Other vulnerabilities in qcubed
See all- CVE-2020-24914Critical
A PHP object injection vulnerability in profile.php of qcubed (all versions including 3.1.1) unserializes untrusted data from the POST variable "strProfileData", allowing an unauthenticated attacker to execute arbitrary code via a crafted POST request.
- CVE-2020-24912Medium
A reflected cross-site scripting (XSS) vulnerability exists in qcubed (all versions including 3.1.1) in profile.php via the stQuery parameter. It allows unauthenticated attackers to steal sessions of authenticated users.
- CVE-2017-20288Medium
QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installation_path parameter. Attackers can craft GET requests to /assets/php/_devtools/installer/step_2.php with malicious installation_path values echoed unescaped, executing JavaScript in victims' browsers.
Original NVD description (English source)
A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS