CVE-2019-16662 PoC — rConfig 操作系统命令注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16662.yaml

Associated Vulnerability

Title:rConfig 操作系统命令注入漏洞 (CVE-2019-16662)
Description:rConfig是一款开源的网络配置管理实用程序。 rConfig 3.9.2版本中存在安全漏洞，该漏洞源于‘rootUname’参数未经过滤便直接发送到‘exec’函数中。攻击者可利用该漏洞执行系统命令。

Description

rConfig 3.9.2 is susceptible to a remote code execution vulnerability. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution.

File Snapshot


 id: CVE-2019-16662

info:
  name: rConfig 3.9.2 - Remote Code Execution
  author: pikpikcu
  severit

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!