qcubed SQL injection vulnerability in profile.php via the strQuery parameter

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2020-24913 · ADVISORY
• qcubed/qcubed#1320 · WEB
• qcubed/qcubed · PACKAGE
• tech.feedyourhead.at/content/QCubed-SQL-Injection-CVE-2020-24913 · WEB
• ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-02 · WEB
• qcubed.com · WEB
• seclists.org/fulldisclosure/2021/Mar/29 · WEB
• seclists.org/fulldisclosure/2021/Mar/30 · WEB
• packetstormsecurity.com/files/161759/QCubed-3.1.1-SQL-Injection.html

qcubed/qcubed のその他の脆弱性

• CVE-2020-24914緊急 9.8A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable "str…
• CVE-2020-24912中 6.1A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allow…