Design/Logic Flaw

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter...

CVE-2020-10221

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter...

CVE-2020-10221

CVE-2020-10221 (rConfig) is a remote code execution vulnerability in the rConfig utility. Multiple connected sources confirm that lib/ajaxHandlers/ajaxAddTemplate.php contains an OS command injection flaw that allows an attacker to execute arbitrary OS commands, by injecting shell metacharacters ...

CVE-2020-10221

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter...

CVE-2020-10221

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter...

CVE-2020-10221

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

PT-2020-6842 · Rconfig · Rconfig

Name of the Vulnerable Software and Affected Versions: rConfig versions 3.94 and earlier Description: The issue exists in the lib/ajaxHandlers/ajaxAddTemplate.php component of the rConfig utility for managing network device configurations, due to the lack of measures to neutralize special element...

CVE-2020-10221: Improper Neutralization of Special Elements used in an OS Command

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter...

CVE-2020-10220

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter...

CVE-2020-10220

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter...

Sql injection

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter...

CVE-2020-10220

CVE-2020-10220 affects rConfig up to v3.9.4, with a SQL injection in the web interface via commands.inc.php searchColumn that can lead to unauthenticated remote code execution. Multiple public exploits (e.g., rConfig 3.9.x) demonstrate chaining SQLi to create an admin user and then trigger a file...

CVE-2020-10220

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter...

CVE-2020-10220

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter...

CVE-2020-10220: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter...

PT-2020-1842

Name of the Vulnerable Software and Affected Versions rConfig versions 3.9.4 and earlier Description The issue is related to a lack of protection against SQL query structure exploitation in the commands.inc.php component of the rConfig utility for managing network device configurations. This can ...

CVE-2020-10220

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter. Recent assessments: theguly at March 12, 2020 3:39pm UTC reported: i love these type of vulnerabilities because they chain three findings normally...

rConfig 3.9 SQL Injection

SQL Injection vulnerability in rConfig commands.inc.php Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

ajaxArchiveFiles.php Command Execution

The vulnerability of the ajaxArchiveFiles.php component, a utility for managing the configuration of rConfig network devices, is related to errors in handling HTTP requests. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on the target system by sending...

rConfig /etc/sudoers Bypass

The vulnerability of the /etc/sudoers component of the rConfig network device configuration management tool is related to insecure management of privileges. Exploiting this vulnerability could allow an attacker to circumvent existing security restrictions...