rConfig RCE (CVE-2020-10221)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(277601);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/12/17");

  script_cve_id("CVE-2020-10221");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2022/05/03");

  script_name(english:"rConfig RCE (CVE-2020-10221)");

  script_set_attribute(attribute:"synopsis", value:
"The version of rConfig installed on the remote host is affected by a remote code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of rConfig installed on the remote host is affected by a remote code executionvulnerability, as 
follows:

  - The flaw exists due to insufficient input validation in the userAdmin.inc.php component, which allows an 
  unauthenticated attacker to upload arbitrary files to the server. By exploiting this, a remote attacker can execute 
  arbitrary PHP code in the context of the web server, effectively gaining full control of the affected system.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10221
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?700e8ea3");
  script_set_attribute(attribute:"solution", value:
"See vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-10221");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/08/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/08/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/12/05");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rconfig:rconfig");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("rconfig_service_detect.nbin");
  script_require_keys("installed_sw/rConfig");

  exit(0);
}

include('vcf.inc');

var app = 'rConfig';
var app_info = vcf::get_app_info(app:app, webapp:TRUE, port:443);

var constraints = [
  { 'fixed_version' : '3.9.5' }
];

vcf::check_version_and_report(
    app_info: app_info,
    constraints: constraints,
    severity: SECURITY_HOLE
);