rConfig 3.9.4 - Cross-Site Scripting

rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php id: CVE-2020-12259 info: name: rConfig 3.9.4 - Cross-Site Scripting...

EUVD-2020-4572

Malware in sbrugna...

CVE-2020-12259

rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php...

CVE-2020-12258

rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are mishandled. The application can reuse a session via PHPSESSID. Also, an attacker can exploit this vulnerability in conjunction with CVE-2020-12256 or CVE-2020-12259...

Session fixation

rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are mishandled. The application can reuse a session via PHPSESSID. Also, an attacker can exploit this vulnerability in conjunction with CVE-2020-12256 or CVE-2020-12259...

CVE-2020-12258

rConfig 3.9.4 is affected by multiple CVEs with concrete details in connected docs. Affected product/component: rConfig 3.9.4 (devicemgmnt.php and related input handling). Root cause: inadequate validation of user-controlled input leading to cross-site scripting (CVE-2020-12256, CVE-2020-12259) a...

CVE-2020-12259

CVE-2020-12259 affects rConfig 3.9.4. The issue is a reflected XSS in the file devicemgmnt.php, caused by improper validation of the rid GET parameter, allowing an attacker to inject arbitrary JavaScript. The NUCLEI template confirms the vulnerability and describes the impact as reflected XSS. Re...