CVEvulnerability
CVE-2020-13448
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-06-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
- Weaknesses
- CWE-78
Description
QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8 allows an authenticated remote attacker to execute code on the server via command injection in the servicestart parameter.
Affected configurations
• quickbox quickbox (<= 2.5.5)
• quickbox quickbox (<= 2.1.8)
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- http://packetstormsecurity.com/files/157898/QuickBox-Pro-2.1.8-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- https://s1gh.sh/cve-2020-13448-quickbox-authenticated-rce/ Exploit, Third Party Advisory
- http://packetstormsecurity.com/files/157898/QuickBox-Pro-2.1.8-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- https://s1gh.sh/cve-2020-13448-quickbox-authenticated-rce/ Exploit, Third Party Advisory