cve/2019/CVE-2019-19509.md

CVE-2019-19509

Description

An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php because the path parameter is passed to the exec function without filtering, which can lead to command execution.

POC

Reference

• http://packetstormsecurity.com/files/156146/rConfig-3.9.3-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/156766/Rconfig-3.x-Chained-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/156950/rConfig-3.9.4-searchField-Remote-Code-Execution.html

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/Orange-Cyberdefense/CVE-repository
• https://github.com/SexyBeast233/SecBooks
• https://github.com/Transmetal/CVE-repository-master
• https://github.com/v1k1ngfr/exploits-rconfig