PT-2021-11396

Name of the Vulnerable Software and Affected Versions: rConfig version 3.9.6 Description: The issue is related to an arbitrary file write vulnerability in the lib/AjaxHandlers/ajaxEditTemplate.php file. This vulnerability allows attackers to execute arbitrary code via a crafted file...

CVE-2020-27466: Missing Authorization

An arbitrary file write vulnerability in lib/AjaxHandlers/ajaxEditTemplate.php of rConfig 3.9.6 allows attackers to execute arbitrary code via a crafted file...

CVE-2020-13778: Improper Neutralization of Special Elements used in an OS Command

rConfig 3.9.4 and earlier allows authenticated code execution of system commands by sending a forged GET request to lib/ajaxHandlers/ajaxAddTemplate.php or lib/ajaxHandlers/ajaxEditTemplate.php...

PT-2020-13676

Name of the Vulnerable Software and Affected Versions rConfig versions 3.9.4 and earlier Description The issue allows authenticated code execution of system commands by sending a forged GET request to specific API endpoints, such as "lib/ajaxHandlers/ajaxAddTemplate.php" or...