exploits-rconfig

exploits Tres exploits para rconfig = 3.9.4 : root@kitploit: CVE-2019-19509 : authenticated RCE CVE-2019-19585 : Local Privilege Escalation root CVE-2020-10220 : unauthenticated SQLi rconfigrootRCEunauth.py : chaining the three CVEs above to get root reverse shell without authentication...

rConfig 3.9.4 - Cross-Site Scripting

rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php id: CVE-2020-12259 info: name: rConfig 3.9.4 - Cross-Site Scripting...

rConfig 3.9.4 - SQL Injection

rConfig 3.9.4 and previous versions have unauthenticated compliancepolicies.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. id: CVE-2020-10546 info: name:...

rConfig 3.9.6 - Local File Inclusion

rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any file on the server. id: CVE-2021-29006 info: name: rConfig 3.9.6 - Local File Inclusion author: r3Y3r53 severity: medium description: | rConfig 3.9.6 is affected by a Local File...

rConfig <= 3.9.4 - Authenticated OS Command Injection

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.9.4 does not properly sanitize the fileName POST parameter before using it in a shell command, allowing an authenticated attacker to inject arbitrary OS commands. This template uses default admin credentials to log in before triggering the...

rConfig 3.9.4 - Server-Side Request Forgery

rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery SSRF via the pathb parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs. id: CVE-2023-39108 info: name: rConf...

rConfig 3.9.4 - Cross-Site Scripting

The rConfig 3.9.4 is vulnerable to cross-site scripting. The devicemgmnt.php file improperly validates the request coming from the user input. Due to this flaw, An attacker can exploit this vulnerability by crafting arbitrary javascript in deviceId GET parameter of devicemgmnt.php resulting in...

rConfig 3.9 - Authentication Bypass(Admin Login)

lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation. This issue has been fixed in 3.9.7. id: CVE-2020-13638 info: name: rConfig 3.9 - Authentication BypassAdmin Login author: theamanrawat severity: critical description: |...

rConfig <=3.9.4 - SQL Injection

rConfig 3.9.4 and prior has unauthenticated snippets.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. id: CVE-2020-10549 info: name: rConfig 3.9.4 or apply th...

rConfig 3.9.4 - SQL Injection

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because nodes' passwords are stored by default in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. id: CVE-2020-10547 info: nam...

rConfig 3.9.4 - SQL Injection

rConfig 3.9.4 and previous versions have unauthenticated devices.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. id: CVE-2020-10548 info: name: rConfig 3.9.4...

rConfig 3.9.4 - Server-Side Request Forgery

rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery SSRF via the path parameter at /ajaxGetFileByPath.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs. id: CVE-2023-39110 info: name: rConfig 3.9.4 - Server-Side...

rConfig 3.9.4 - Server-Side Request Forgery

rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery SSRF via the patha parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs. id: CVE-2023-39109 info: name: rConf...

CVE-2019-19268

CVE-2019-19268 Versión afectada: rConfig 3.9.2. Descripción Múltiples vectores de ataque en rConfig v3.9.2 debido a una mala configuración, lo que permite a los usuarios locales ejecutar comandos root mediante sudo. Descubridores dmw0ng - Discord: dmw0ng4449 TheCyberGeek - Discord: TheCyberGeek18...

rConfig 3.9 - SQL Injection

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter. id: CVE-2020-10220 info: name: rConfig 3.9 - SQL Injection author: ritikchaddha,theamanrawat severity: critical description: | An issue was discovered i...

rConfig_rce

rConfig 3.9 PoC combinado de Inyección SQL e Inyección de Comandos Resumen Este PoC está dirigido a la versión 3.9.4 de rConfig y demuestra la explotación mediante una combinación de vulnerabilidades de Inyección SQL e Inyección Remota de Comandos. Automatiza el proceso de: 1. Extraer el nombre d...

CVE-2019-16662

CVE-2019-16662 The official exploit for rConfig 3.9.2 Remote Code Execution CVE-2019-16662...

rConfig 3.9.2 - Remote Code Execution

rConfig 3.9.2 is susceptible to a remote code execution vulnerability. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution. id:...

CVE-2026-77914

rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal...

CVE-2026-77915

rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes call in routes/web.php that re-enables the POST /register route after it was...