PHP Object Injection Vulnerability in QCubed by Qcubed Inc.
CVE-2020-24914

9.8CRITICAL

Key Information:

Vendor

Qcubed

Status
Qcubed
Vendor
CVE Published:
4 March 2021

What is CVE-2020-24914?

A vulnerability in profile.php of QCubed enables an unauthenticated attacker to exploit a PHP object injection flaw. The issue arises from the unsafe handling of untrusted data in the 'strProfileData' POST variable, which allows attackers to craft malicious POST requests that can lead to arbitrary code execution, compromising the security of the application.

References

https://www.ait.ac.at/themen/cyber-security/pentesting/se...
https://tech.feedyourhead.at/content/QCubed-PHP-Object-In...
http://seclists.org/fulldisclosure/2021/Mar/28
mailing-list

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.