CVE-2020-10221

rConfig OS Command Injection Vulnerability

Rconfig

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter.

8. Mär 2020

Ausgewertete Quellen

• Hinweis
  http://packetstormsecurity.com/files/156687/rConfig-3.93-Authenticated-Remote-Code-Execution.html
• Hinweis
  https://cwe.mitre.org/data/definitions/78.html
• Hinweis
  https://engindemirbilek.github.io/rconfig-3.93-rce
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10221
• CISA
  rConfig OS Command Injection Vulnerability
• NVD
  CVE-2020-10221
• GitHub
  https://github.com/EnginDemirbilek/EnginDemirbilek.github.io/blob/master/rconfig-3.93-rce.html