PT-2019-15823 · Rconfig · Rconfig

Name of the Vulnerable Software and Affected Versions: rConfig versions 3.9.3 and earlier Description: A downloadFile.php download file path traversal issue allows attackers to list files in arbitrary folders and potentially download files. The discoverer reported that there was not a fully worki...

CVE-2019-19372: Improper Limitation of a Pathname to a Restricted Directory

A downloadFile.php downloadfile path traversal vulnerability in rConfig through 3.9.3 allows attackers to list files in arbitrary folders and potentially download files. NOTE: the discoverer later reported that there was not a "fully working exploit...

Exploit for CVE-2019-19268

CVE-2019-19268 Affected Version: rConfig 3.9.2. Descriptio...

rConfig <= 3.9.2 Authenticated SQL Injection Vulnerability

rConfig is prone to an authenticated SQL injection vulnerability in devices.php?searchColumn=. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-lat...

rConfig SQL Injection Vulnerability (CNVD-2020-41583)

rConfig is an open source network device configuration management utility . A SQL injection vulnerability exists in rConfig version 3.9.2, which stems from a lack of validation of externally entered SQL statements in database-based applications, and can be exploited by an attacker to execute...

CVE-2019-19207

rConfig 3.9.2 allows devices.php?searchColumn= SQL injection...

CVE-2019-19207

rConfig 3.9.2 allows devices.php?searchColumn= SQL injection...

Sql injection

rConfig 3.9.2 allows devices.php?searchColumn= SQL injection...

CVE-2019-19207

CVE-2019-19207 affects rConfig 3.9.2, where an SQL injection is possible via devices.php?searchColumn=. The root cause is lack of input validation in the application that allows SQL statements to be injected. Impact is high across confidentiality, integrity, and availability (per CVSS 3.1: 8.8; p...

CVE-2019-19207

rConfig 3.9.2 allows devices.php?searchColumn= SQL injection...

CVE-2019-19207: Improper Neutralization of Special Elements used in an SQL Command

rConfig 3.9.2 allows devices.php?searchColumn= SQL injection...

rConfig - install Command Execution Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'rConfig install Command Execution', 'Description' = %q This module exploits an unauthenticated command injection vulnerability in rConfig version...

rConfig - install Command Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'rConfig install Command Execution', 'Description' = %q This module exploits an unauthenticated command injection vulnerability in rConfig version...

PT-2019-4524 · Rconfig · Rconfig

Name of the Vulnerable Software and Affected Versions: rConfig version 3.9.3 Description: The issue is related to errors in handling HTTP requests in the ajaxArchiveFiles.php component of the rConfig utility for managing network device configurations. Exploitation of this issue may allow a remote...

rConfig 3.9.2 Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'rConfig install Command Execution', 'Description' = %q This module exploits an unauthenticated command injection vulnerability in rConfig version...

rConfig < 3.9.3 Unauthenticated RCE Vulnerability - Active Check

rConfig is prone to an unauthenticated remote code execution RCE vulnerability in ajaxServerSettingsChk.php. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

rConfig Remote Code Execution (CVE-2019-16662; CVE-2019-16663)

A remote code execution vulnerability exists in rConfig. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

rConfig < 3.9.3 Multiple RCE Vulnerabilities - Version Check

rConfig is prone to multiple remote code execution RCE vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

rConfig Detection

Detection of rConfig. The script sends a connection request to the server and attempts to detect rConfig. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Critical Remote Code Execution Flaw Found in Open Source rConfig Utility

Two bugs in the network configuration utility rConfig have been identified, both allowing remote code execution on affected systems. Worse, one is rated critical and allows for a user to attack a system remotely – sans authentication. RConfig is a free open-source configuration management utility...