CVE-2020-13448

Name of the Vulnerable Software and Affected Versions QuickBox Community Edition versions 2.5.5 and earlier QuickBox Pro Edition versions 2.1.8 and earlier

Description The issue allows an authenticated remote attacker to execute code on the server. This is achieved through command injection in the servicestart parameter.

Recommendations For QuickBox Community Edition versions 2.5.5 and earlier, update to a version that contains a fix for this issue. For QuickBox Pro Edition versions 2.1.8 and earlier, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the servicestart parameter to minimize the risk of exploitation.