Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2019-19509: rConfig 3.9.3 lets logged‑in users run commands remotely
CVE-2019-19509 · published 6 years ago
Summary
In rConfig version 3.9.3, a logged‑in user can send a specially crafted request to the web interface and cause the server to execute any command they choose. This could let an attacker take control of the server or expose data. Apply the vendor’s update or patch that corrects the input handling and restrict web‑admin access to trusted users.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| rconfig | rconfig |
3.9.3 cpe:2.3:a:rconfig:rconfig:3.9.3:*:*:*:*:*:*:* |
Original advisory text
An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php because the path parameter is passed to t...
An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php because the path parameter is passed to the exec function without filtering, which can lead to command execution.
References
- http://packetstormsecurity.com/files/156146/rConfig-3.9.3-Remote-Code-Execution.... Exploit Third Party Advisory VDB Entry
- http://packetstormsecurity.com/files/156766/Rconfig-3.x-Chained-Remote-Code-Exec... Exploit Third Party Advisory VDB Entry
- http://packetstormsecurity.com/files/156950/rConfig-3.9.4-searchField-Remote-Cod... Exploit Third Party Advisory VDB Entry
- https://github.com/v1k1ngfr Exploit Third Party Advisory
- https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_CVE-2019-19509.... Exploit Third Party Advisory
- https://raw.githubusercontent.com/v1k1ngfr/exploits/master/rconfig_exploit.py?to... Broken Link
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-78OS Command Injection
Timeline
Published6 Jan 2020
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2019-19509 · NVD
Track software like this
Free during beta