An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php because the path parameter is passed to the exec function without filtering, which can lead to command execution.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2020-01-06T19:27:27
Updated: 2024-08-05T02:16:48.197Z
Reserved: 2019-12-02T00:00:00
Link: CVE-2019-19509
Vulnrichment
No data.
NVD
Status : Modified
Published: 2020-01-06T20:15:12.350
Modified: 2024-11-21T04:34:51.587
Link: CVE-2019-19509
Redhat
No data.