Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-24914

CVE-2020-24914: qcubed PHP object injection

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-24914
GHSA ID
GHSA-7w3c-jgh7-cwjw
EPSS Score
0.97038%
CWE
CWE-915
Published
5/24/2022
Updated
4/24/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
qcubed/qcubedcomposer<= 3.1.13.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems directly from the line '$objProfileArray = unserialize(base64_decode($_POST['strProfileData']));' in profile.php. PHP's unserialize() with user-controlled input is a well-known anti-pattern (CWE-502). The function: 1) Processes raw POST input, 2) Lacks cryptographic signatures or type checks, 3) Exists in an unauthenticated endpoint. The patch in v3.2 adds profiling disable capability but the root vulnerability is the unsafe unserialize() call itself.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* P*P o*j**t inj**tion *u* in pro*il*.p*p in q*u*** (*ll v*rsions in*lu*in* *.*.*) uns*ri*liz*s t** untrust** **t* o* t** POST-v*ri**l* "strPro*il***t*" *n* *llows *n un*ut**nti**t** *tt**k*r to *x**ut* *o** vi* * *r**t** POST r*qu*st.

Reasoning

T** vuln*r**ility st*ms *ir**tly *rom t** lin* '$o*jPro*il**rr*y = uns*ri*liz*(**s***_***o**($_POST['strPro*il***t*']));' in pro*il*.p*p. P*P's uns*ri*liz*() wit* us*r-*ontroll** input is * w*ll-known *nti-p*tt*rn (*W*-***). T** *un*tion: *) Pro**ss*