CVE-2019-19509

2020-01-06T20:15:00
ID CVE-2019-19509
Type cve
Reporter cve@mitre.org
Modified 2020-01-30T18:15:00

Description

An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php because the path parameter is passed to the exec function without filtering, which can lead to command execution.