Direkt zum Inhalt
Symbolfoto: Das AIT ist Österreichs größte außeruniversitäre Forschungseinrichtung


QCubed: PHP Object Injection

Identifier: AIT-SA-20210215-01
Target: QCubed Framework
Vendor: QCubed
Version: all versions including 3.1.1
CVE: CVE-2020-24914
Accessibility: Remote
Severity: Critical
Author: Wolfgang Hotwagner (AIT Austrian Institute of Technology)



QCubed is a PHP Model-View-Controller Rappid Application Development framework.

Vulnerability Description

A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request.



Vulnerable Versions

All versions including 3.1.1 are affected.

Tested Versions

QCubed 3.1.1


An unauthenticated attacker could  execute code remotely.


A patch was delivered by QCubed that allows to disable the profile-functionality.


Vendor Contact Timeline

2020-04-19 Contacting the vendor
2020-04-19 Vendor replied
2020-05-01 Vendor released a patch at Github
2021-02-15 Public disclosure

Advisory URL