CVE-2020-10549

rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

PT-2020-12198

Name of the Vulnerable Software and Affected Versions rConfig versions 3.9.4 and previous versions Description The issue is related to an unauthenticated SQL injection in snippets.inc.php, which can lead to lateral movement. Since nodes' passwords are stored in cleartext by default, an attacker c...

CVE-2020-10549: Improper Neutralization of Special Elements used in an SQL Command

rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...