CVE-2020-10220

Related Files

rConfig 3.9.4 searchField Remote Code Execution

Posted Mar 28, 2020

Authored by vikingfr

rConfig version 3.9.4 searchField unauthenticated remote root code execution exploit.

tags | exploit, remote, root, code execution

advisories | CVE-2019-19509, CVE-2019-19585, CVE-2020-10220

SHA-256 | 286d169b9325c701681f3ca01b90d56974a51fe70471f6d1ba94a2d175b1f7a8

Download | Favorite | View

Rconfig 3.x Chained Remote Code Execution

Posted Mar 16, 2020

Authored by Orange Cyberdefense, Jean-Pascal Thomas | Site metasploit.com

This Metasploit module takes advantage of a command injection vulnerability in the path parameter of the ajax archive file functionality within the rConfig web interface in order to execute the payload. Valid credentials for a user with administrative privileges are required . However, this module can bypass authentication via SQL injection.

tags | exploit, web, sql injection

advisories | CVE-2019-19509, CVE-2020-10220

SHA-256 | 0b63805ab8f2162cb70c5931c392c85432cadbdd98208528d5861e068261cd6c

Download | Favorite | View

rConfig 3.9 SQL Injection

Posted Mar 11, 2020

Authored by vikingfr

rConfig version 3.9 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection

advisories | CVE-2020-10220

SHA-256 | a8428e6dd617bc7a6966d1ff349fff0c9d819ba218d51a40871dcbe6a40f4dac

Download | Favorite | View