Description
In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user can execute sudo mysql without a password, which means that the www-data user can execute arbitrary OS commands via the mysql -e option.
Unscored
CVE-2020-13694
EUVD-2020-5917GHSA-6fh9-x2xg-3264
In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user can execute sudo mysql without a passwor…
Published Jun 1, 2020 · Updated Aug 4, 2024 · Assigned by mitre