CVE-2020-20944
📋 TL;DR
This vulnerability in Qibosoft v7 allows attackers to delete arbitrary files via the /admin/index.php endpoint with specific parameters. Attackers can potentially delete critical system files, configuration files, or application data. All systems running vulnerable versions of Qibosoft v7 are affected.
💻 Affected Systems
- Qibosoft
📦 What is this software?
Qibosoft by Qibosoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical system files, leading to service disruption, data loss, or enabling further attacks by removing security controls.
Likely Case
Application disruption through deletion of configuration files, database files, or web content, causing downtime and potential data loss.
If Mitigated
Limited impact with proper file permissions and access controls preventing deletion of critical files.
🎯 Exploit Status
Exploitation requires access to the admin interface but no authentication bypass is mentioned in references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No vendor advisory found in provided references
Restart Required: No
Instructions:
Check vendor website for updates or consider upgrading to newer versions if available.
🔧 Temporary Workarounds
Restrict access to admin interface
allLimit access to /admin/ directory to trusted IP addresses only
# Apache: <Location /admin/>
# Order deny,allow
# Deny from all
# Allow from 192.168.1.0/24
# </Location>
# Nginx: location /admin/ {
# allow 192.168.1.0/24;
# deny all;
# }
Implement proper file permissions
linuxSet restrictive permissions on critical directories and files
chmod 644 /path/to/qibosoft/*.php
chmod 755 /path/to/qibosoft/
chmod 600 /path/to/qibosoft/config/
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block requests containing 'lfj=mysql&action=del' parameters
- Monitor and alert on file deletion attempts in the application logs
🔍 How to Verify
Check if Vulnerable:
Check if your system runs Qibosoft v7 and has the /admin/index.php endpoint accessibleCheck Version:
Check application files or documentation for version informationVerify Fix Applied:
Test if the vulnerable endpoint still allows file deletion after implementing controls📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /admin/index.php with parameters lfj=mysql&action=del
- File deletion events in system logs corresponding to web requests
Network Indicators:
- HTTP POST/GET requests containing 'action=del' parameter patterns
SIEM Query:
source="web_access.log" AND uri_path="/admin/index.php" AND (query_string="*lfj=mysql*" OR query_string="*action=del*")