CVE-2020-13448

QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8 allows an authenticated remote attacker to execute code on the server via command injection in the servicestart parameter.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

17.40% chance of exploitation in the next 30 days, 97th percentile

Published

2020-06-01

Updated

2024-08-04

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/157898/QuickBox-Pro-2.1.8-Remote-Code-Execution.html

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/48536

References

• CVE Record
• NVD entry

Related

• CVE-2020-13443
• CVE-2020-13449
• CVE-2020-13438
• CVE-2020-13450
• CVE-2020-13435
• CVE-2020-13451