CVE-2019-16663

An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to search.crud.php because the catCommand parameter is passed to the exec function without filtering, which can lead to command execution.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 99%
VendorProductVersion
rconfigrconfig
3.9.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://drive.google.com/open?id=1XmR2MSMb3cKARFk3XxmPkwz6GhAP1JxL
https://drive.google.com/open?id=1kQGmboKfwob4RwlMjnv6ER2Za1GUptOi
https://gist.github.com/mhaskar/e7e454c7cb0dd9a139b0a43691e258a0
https://rconfig.com/download
https://shells.systems/rconfig-v3-9-2-authenticated-and-unauthenticated-rce-cve-2019-16663-and-cve-2019-16662/
https://drive.google.com/open?id=1XmR2MSMb3cKARFk3XxmPkwz6GhAP1JxL
https://drive.google.com/open?id=1kQGmboKfwob4RwlMjnv6ER2Za1GUptOi
https://gist.github.com/mhaskar/e7e454c7cb0dd9a139b0a43691e258a0
https://rconfig.com/download
https://shells.systems/rconfig-v3-9-2-authenticated-and-unauthenticated-rce-cve-2019-16663-and-cve-2019-16662/