An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to search.crud.php because the catCommand parameter is passed to the exec function without filtering, which can lead to command execution.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2019-10-28T11:53:02

Updated: 2024-08-05T01:17:41.062Z

Reserved: 2019-09-21T00:00:00

Link: CVE-2019-16663

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2019-10-28T12:15:10.487

Modified: 2024-11-21T04:30:55.783

Link: CVE-2019-16663

cve-icon Redhat

No data.