Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2020-10879: rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped.
CVE-2020-10879 · published 6 years ago
Summary
rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped.
What to do
- Update rconfig rconfig to version 3.9.5 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| rconfig | rconfig |
< 3.9.5 cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:* |
Original advisory text
rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped.
rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped.
References
- https://github.com/rconfig/rconfig/commit/3385f906427d228c48b914625136bf620f4ca0... Patch
- https://www.exploit-db.com/exploits/48241 Exploit Third Party Advisory VDB Entry
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-78OS Command Injection
Timeline
Published23 Mar 2020
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2020-10879 · NVD
Track software like this
Free during beta