QCubed PHP Object Injection (CVE-2020-24914)

2 March 2021

Identifier: AIT-SA-20210215-01
Target: QCubed Framework
Vendor: QCubed
Version: all versions including 3.1.1
CVE: CVE-2020-24914
Accessibility: Remote
Severity: Critical
Author: Wolfgang Hotwagner (AIT Austrian Institute of Technology)


QCubed is a PHP Model-View-Controller Rappid Application Development framework.

Vulnerability Description

A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable “strProfileData” and allows an unauthenticated attacker to execute code via a crafted POST request.

Vulnerable Versions

All versions including 3.1.1 are affected.

Tested Versions

QCubed 3.1.1


An unauthenticated attacker could execute code remotely.


A patch was delivered by QCubed that allows to disable the profile-functionality.

Vendor Contact Timeline

2020-04-19 Contacting the vendor
2020-04-19 Vendor replied
2020-05-01 Vendor released a patch at Github
2021-02-15 Public disclosure

Advisory URL

[ PHP  Programming  Web  Security  CVE  ]
Except where otherwise noted, content on this site is licensed under a Creative Commons Attribution 3.0 Unported License.

Copyright 2015-present Hoti