lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.9.4 does not properly sanitize the fileName POST parameter before using it in a shell command, allowing an authenticated attacker to inject arbitrary OS commands. This template uses default admin credentials to log in before triggering the injection; override the username / userpassword fields for environments with changed credentials.
登录后查看神龙缓存的 POC 文件快照
登录查看