CVE-2020-10220

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• Rconfig 3.x - Chained Remote Code Execution (Metasploit)2020-03-17 · remote · linux · Verified
• rConfig 3.9 - 'searchColumn' SQL Injection2020-03-12 · webapps · php

Impact

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• http://packetstormsecurity.com/files/156688/rConfig-3.9-SQL-Injection.html
• http://packetstormsecurity.com/files/156766/Rconfig-3.x-Chained-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/156950/rConfig-3.9.4-searchField-Remote-Code-Execution.html
• https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_CVE-2020-10220.py
• https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_sqli.py
• http://packetstormsecurity.com/files/156688/rConfig-3.9-SQL-Injection.html
• http://packetstormsecurity.com/files/156766/Rconfig-3.x-Chained-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/156950/rConfig-3.9.4-searchField-Remote-Code-Execution.html
• https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_CVE-2020-10220.py
• https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_sqli.py