critical9.8Public exploit code
CVE-2020-10879
rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- rConfig 3.9.4 - 'search.crud.php' Remote Command Injection2020-03-23 · webapps · php
Impact
rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rconfig | Rconfig | before 3.9.5 |