CVE-2017-20288
CVE-2017-20288 · QCubed 3.1.1 Reflected XSS via installer step_2.php
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installation_path parameter. Attackers can craft GET requests to /assets/php/_devtools/installer/step_2.php with malicious installation_path values echoed unescaped, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
CVSS 5.1 · Media · EPSS 0,3%
- Publicación
- Actualización
Productos y versiones afectados
qcubed
- Versiones
- ≥ 2.2.0, ≤ 3.1.1: Afectada (custom)
Sin corrección publicada