CVE-2020-24914
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
A PHP object injection vulnerability in profile.php of qcubed (all versions including 3.1.1) unserializes untrusted data from the POST variable "strProfileData", allowing an unauthenticated attacker to execute arbitrary code via a crafted POST request.
Risk Assessment
An unauthenticated attacker can gain full control of the server, steal sensitive data, or deploy malware, leading to complete system compromise.
Recommendation
Immediately update qcubed to a patched version. If unavailable, implement input validation and sanitization before deserialization as a workaround.
Other vulnerabilities in qcubed
See all- CVE-2020-24913Critical
A SQL injection vulnerability in qcubed (all versions up to 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.
- CVE-2020-24912Medium
A reflected cross-site scripting (XSS) vulnerability exists in qcubed (all versions including 3.1.1) in profile.php via the stQuery parameter. It allows unauthenticated attackers to steal sessions of authenticated users.
Original NVD description (English source)
A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request.