CVE-2020-10548 PoC — rConfig SQL注入漏洞

来源

关联漏洞

Description

rConfig 3.9.4 and previous versions have unauthenticated devices.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.

文件快照

 id: CVE-2020-10548

info:
  name: rConfig 3.9.4 - SQL Injection
  author: madrobot
  severity: criti

...

备注