qcubed SQL injection vulnerability in profile.php via the strQuery parameter

CRITICAL 9.8CVE-2020-24913 · GHSA-8fj6-pc5r-347q · Published 04/03/2021 · updated 09/07/2026

Package	Affected versions	Patched versions
qcubed/qcubed Packagist	`< 3.2`	`3.2`
qcubed qcubed	`≤ 3.1.1`	No fix yet

Description

A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2020-24913 · ADVISORY
qcubed/qcubed#1320 · WEB
qcubed/qcubed · PACKAGE
tech.feedyourhead.at/content/QCubed-SQL-Injection-CVE-2020-24913 · WEB
ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-02 · WEB
qcubed.com · WEB
seclists.org/fulldisclosure/2021/Mar/29 · WEB
seclists.org/fulldisclosure/2021/Mar/30 · WEB
packetstormsecurity.com/files/161759/QCubed-3.1.1-SQL-Injection.html

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free