Published: 06/01/2020 Updated: 31/01/2023

CVSS v2 Base Score: 9 | Impact Score: 10 | Exploitability Score: 8

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 905

Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C

An issue exists in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php because the path parameter is passed to the exec function without filtering, which can lead to command execution.

Vulnerable Product	Search on Vulmon	Subscribe to Product
rconfig rconfig 3.9.3

## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'Rconf ...

rConfig version 393 suffers from an authenticated remote code execution vulnerability ...

This Metasploit module takes advantage of a command injection vulnerability in the path parameter of the ajax archive file functionality within the rConfig web interface in order to execute the payload Valid credentials for a user with administrative privileges are required However, this module can bypass authentication via SQL injection ...

rConfig version 394 searchField unauthenticated remote root code execution exploit ...

Exploit codes for rconfig <= 3.9.4

exploits Three exploits for rconfig <= 394 : CVE-2019-19509 : authenticated RCE CVE-2019-19585 : Local Privilege Escalation (root) CVE-2020-10220 : unauthenticated SQLi rconfig_root_RCE_unauthpy : chaining the three CVEs above to get root reverse shell without authentication rconfig_ajaxarchivefiles_rcerb : Rconfig 3x - Chained Remote

CWE-78 https://github.com/v1k1ngfr https://raw.githubusercontent.com/v1k1ngfr/exploits/master/rconfig_exploit.py?token=https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_CVE-2019-19509.py http://packetstormsecurity.com/files/156146/rConfig-3.9.3-Remote-Code-Execution.html http://packetstormsecurity.com/files/156766/Rconfig-3.x-Chained-Remote-Code-Execution.html http://packetstormsecurity.com/files/156950/rConfig-3.9.4-searchField-Remote-Code-Execution.html https://nvd.nist.gov https://github.com/v1k1ngfr/exploits-rconfig https://www.exploit-db.com/exploits/48223

CVE-2019-19509

Vulnerability Summary

Vulnerability Trend

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect