CVE-2021-44981
HIGHQuickBox Pro <= 2.5.8 - Remote Code Execution via config.php GET Parameter
Title source: llmDescription
In QuickBox Pro v2.5.8 and below, the config.php file has a variable which takes a GET parameter value and parses it into a shell_exec(''); function without properly sanitizing any shell arguments, therefore remote code execution is possible. Additionally, as the media server is running as root by default attackers can use the sudo command within this shell_exec(''); function, which allows for privilege escalation by means of RCE.
References (2)
Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://websec.nl/blog/61b2b37a43a1155c848f3b08/websec%20finds%20critical%20vulnerabilities%20in%20popular%20media%20server
Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/QuickBox/QB/issues/202
Scores
CVSS v3
8.8
EPSS
0.0367
EPSS Percentile
88.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-78
Status
published
Products (1)
quickbox/quickbox
< 2.5.8 (2 CPE variants)
Published
Jan 24, 2022
Tracked Since
Feb 18, 2026