CVE-2019-16662

Related Files

rConfig 3.9.2 Command Injection

Posted Nov 7, 2019

Authored by Brendan Coles, mhaskar | Site metasploit.com

This Metasploit module exploits an unauthenticated command injection vulnerability in rConfig versions 3.9.2 and prior. The install directory is not automatically removed after installation, allowing unauthenticated users to execute arbitrary commands via the ajaxServerSettingsChk.php file as the web server user. This module has been tested successfully on rConfig version 3.9.2 on CentOS 7.7.1908 (x64).

tags | exploit, web, arbitrary, php

systems | linux, centos

advisories | CVE-2019-16662

SHA-256 | c186325528acbfb5de4f3fa7f089b9e55a0ed4689c4440a3e05bf3134759a1f7

Download | Favorite | View

rConfig 3.9.2 Remote Code Execution

Posted Oct 29, 2019

Authored by Askar

rConfig version 3.9.2 suffers from a remote code execution vulnerability.

tags | exploit, remote, code execution

advisories | CVE-2019-16662

SHA-256 | b12301a0ed841ed2491b8a64294909e610a8429eb92ca588af2b200c19495a88

Download | Favorite | View