critical9.8Public exploit code
CVE-2020-11819
In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Rukovoditel 2.6.1 - RCE (1)2020-12-11 · webapps · php
- Rukovoditel 2.7.1 - Remote Code Execution (2) (Authenticated)2020-09-02 · webapps · php
Impact
In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rukovoditel | Rukovoditel | Version 2.5.2 |