{"id":"CVE-2020-24913","title":"A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.","summary":"A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-89"],"vendor":"qcubed","product":"qcubed","affected":["qcubed <= 3.1.1"],"published":"2021-03-04","updated":"2026-07-05","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2020-24913","references":[{"url":"http://packetstormsecurity.com/files/161759/QCubed-3.1.1-SQL-Injection.html","label":"cve@mitre.org"},{"url":"http://seclists.org/fulldisclosure/2021/Mar/29","label":"cve@mitre.org"},{"url":"http://seclists.org/fulldisclosure/2021/Mar/30","label":"cve@mitre.org"},{"url":"https://tech.feedyourhead.at/content/QCubed-SQL-Injection-CVE-2020-24913","label":"cve@mitre.org"},{"url":"https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-02","label":"cve@mitre.org"},{"url":"http://qcubed.com","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2021/Mar/29","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2021/Mar/30","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://tech.feedyourhead.at/content/QCubed-SQL-Injection-CVE-2020-24913","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-02","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","exploit-available"],"epss":0.40886,"epssPercentile":0.98594,"ingestedAt":"2026-07-05T00:59:25.827Z","exploits":{"github":2,"githubRepos":["https://github.com/agarma/CVE-2020-24913-PoC","https://github.com/shpaw415/CVE-2020-24913-exploit"],"checkedAt":"2026-09-23T07:13:17.579Z"},"exploitAvailable":true,"slug":"CVE-2020-24913","body":"## Overview\n\nA SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.\n\n## Affected\n\n- `qcubed <= 3.1.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":74,"depthScoreParts":{"impact":53.9,"likelihood":8.2,"exploitation":12,"ransomware":0},"changes":[{"seq":4489,"id":"CVE-2020-24913","ts":1788887184156,"field":"exploit_available","old":"false","new":"true"},{"seq":3372,"id":"CVE-2020-24913","ts":1788886302954,"field":"exploit_available","old":"true","new":"false"},{"seq":2227,"id":"CVE-2020-24913","ts":1788882972590,"field":"exploit_available","old":"false","new":"true"},{"seq":1256,"id":"CVE-2020-24913","ts":1788882384209,"field":"exploit_available","old":"true","new":"false"},{"seq":370,"id":"CVE-2020-24913","ts":1788881819583,"field":"exploit_available","old":"false","new":"true"}]}