CVE-2017-20288: QCubed 3.1.1 Reflected XSS via installer step_2.php
QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installationpath parameter. Attackers can craft GET requests to /assets/php/devtools/installer/step2.php with malicious installationpath values echoed unescaped, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can send a crafted GET request; no account or prior privileges are required. Successful exploitation requires a victim's browser to load the crafted installer URL.
Which deployments should be checked first?
Check QCubed versions 2.2.0 through 3.1.1 where /assets/php/_devtools/installer/step_2.php is reachable. The affected parameter is installation_path.
Has exploitation been observed?
Yes. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.