CVE-2017-20288
CVE-2017-20288 · QCubed 3.1.1 Reflected XSS via installer step_2.php
This page contains facts from public vulnerability sources. Check the original advisory before updating.
QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installation_path parameter. Attackers can craft GET requests to /assets/php/_devtools/installer/step_2.php with malicious installation_path values echoed unescaped, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
CVSS 5.1 · Medium · EPSS 0.3%
- Published
- Updated
Affected products and versions
qcubed
- Versions
- ≥ 2.2.0, ≤ 3.1.1: Affected (custom)
No fix published