CVE-2020-13638 PoC — rConfig 授权问题漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13638.yaml

Associated Vulnerability

Title:rConfig 授权问题漏洞 (CVE-2020-13638)
Description:rConfig是一款开源的网络配置管理实用程序。 rConfig 3.9.x系列3.9.7之前版本存在安全漏洞，该漏洞源于lib/crud/userprocess.php存在身份验证绕过，导致创建管理员帐户。

Description

lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation. This issue has been fixed in 3.9.7.

File Snapshot


 id: CVE-2020-13638

info:
  name: rConfig 3.9 - Authentication Bypass(Admin Login)
  author: theaman

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!