CVE-2020-10221: Improper Neutralization of Special Elements used in an OS Command

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter...

CVE-2020-10220

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter...

CVE-2020-10220

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter...

Sql injection

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter...

CVE-2020-10220

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter...

CVE-2020-10220

CVE-2020-10220 affects rConfig up to v3.9.4, with a SQL injection in the web interface via commands.inc.php searchColumn that can lead to unauthenticated remote code execution. Multiple public exploits (e.g., rConfig 3.9.x) demonstrate chaining SQLi to create an admin user and then trigger a file...

CVE-2020-10220

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter. Recent assessments: theguly at March 12, 2020 3:39pm UTC reported: i love these type of vulnerabilities because they chain three findings normally...

CVE-2020-10220: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter...

rConfig 3.9 SQL Injection

SQL Injection vulnerability in rConfig commands.inc.php Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

The vulnerability of the ajaxArchiveFiles.php component, a utility for managing the configuration of rConfig network devices, allows an attacker to execute arbitrary commands on the target system.

The vulnerability of the ajaxArchiveFiles.php component, a utility for managing the configuration of rConfig network devices, is related to errors in handling HTTP requests. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on the target system by sending...

The vulnerability in the /etc/sudoers component of the rConfig utility, which manages network device configurations, allows a hacker to circumvent existing security restrictions.

The vulnerability of the /etc/sudoers component of the rConfig network device configuration management tool is related to insecure management of privileges. Exploiting this vulnerability could allow an attacker to circumvent existing security restrictions...

rConfig 3.9.3 Remote Code Execution

Exploit Title: rConfig 3.9.3 - Authenticated Remote Code Execution Date: 2019-11-07 CVE-2019-19509 Exploit Author: vikingfr Vendor Homepage: https://rconfig.com/ see also : https://github.com/rconfig/rconfig Software Link : http://files.rconfig.com/downloads/scripts/centos7install.sh Version:...

rConfig 3.9.3 - Authenticated Remote Code Execution Exploit

Exploit for php platform in category web applications Exploit Title: rConfig 3.9.3 - Authenticated Remote Code Execution CVE-2019-19509 Exploit Author: vikingfr Vendor Homepage: https://rconfig.com/ see also : https://github.com/rconfig/rconfig Software Link :...

rConfig 3.9.3 - Authenticated Remote Code Execution

Exploit Title: rConfig 3.9.3 - Authenticated Remote Code Execution Date: 2019-11-07 CVE-2019-19509 Exploit Author: vikingfr Vendor Homepage: https://rconfig.com/ see also : https://github.com/rconfig/rconfig Software Link : http://files.rconfig.com/downloads/scripts/centos7install.sh Version:...

rConfig 3.9.3 - Authenticated Remote Code Execution

rConfig 3.9.3 - Authenticated Remote Code Execution Exploit Title: rConfig 3.9.3 - Authenticated Remote Code Execution Date: 2019-11-07 CVE-2019-19509 Exploit Author: vikingfr Vendor Homepage: https://rconfig.com/ see also : https://github.com/rconfig/rconfig Software Link :...

rConfig <= 3.9.6 Multiple Vulnerabilities

rConfig is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

rConfig Remote Code Execution Vulnerability

rConfig is an open source network configuration management utility . A security vulnerability exists in rConfig version 3.9.3, which originates from the program failing to filter before passing the 'path' parameter directly to the 'exec' function. The vulnerability can be exploited by a remote...

Unspecified vulnerability in rConfig

rConfig is an open source network configuration management utility . A security vulnerability exists in rConfig version 3.9.3. An attacker can exploit this vulnerability to bypass local security restrictions...

CVE-2019-19585

An issue was discovered in rConfig 3.9.3. The install script updates the /etc/sudoers file for rconfig specific tasks. After an "rConfig specific Apache configuration" update, apache has high privileges for some binaries. This can be exploited by an attacker to bypass local security restrictions...

CVE-2019-19509

An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php because the path parameter is passed to the exec function without filtering, which can lead to command execution...