CVE-2020-24913: SQL Injection
A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/qcubed/qcubedto a version that resolves this vulnerability.Fixed in 3.2
Event History
Frequently Asked Questions
What is CVE-2020-24913?
CVE-2020-24913 is a SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php.
How does CVE-2020-24913 impact the system?
CVE-2020-24913 allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.
What is the severity of CVE-2020-24913?
CVE-2020-24913 has a severity of critical with a CVSS score of 9.8.
How can I fix CVE-2020-24913?
To fix CVE-2020-24913, it is recommended to update qcubed to a version higher than 3.1.1.
Where can I find more information about CVE-2020-24913?
More information about CVE-2020-24913 can be found at the following references: [Reference 1](http://qcubed.com), [Reference 2](http://seclists.org/fulldisclosure/2021/Mar/29), [Reference 3](http://seclists.org/fulldisclosure/2021/Mar/30).