CVE-2019-16662

This Metasploit module exploits an unauthenticated command injection vulnerability in rConfig via the `ajaxServerSettingsChk.php` file. It supports both in-memory and dropper-based payloads for Unix/Linux targets.

This exploit targets a remote code execution vulnerability in rConfig 3.9.2 by injecting a PHP payload via the `rootUname` parameter in an unauthenticated request to `/install/lib/ajaxHandlers/ajaxServerSettingsChk.php`. The payload establishes a reverse shell to a specified IP and port.

This repository contains a functional Python exploit for CVE-2019-16662, targeting rConfig 3.9.2. The exploit leverages an unauthenticated remote code execution vulnerability by injecting a reverse shell payload via the `ajaxServerSettingsChk.php` endpoint.

This Metasploit module exploits an unauthenticated command injection vulnerability in rConfig versions 3.9.2 and prior via the `ajaxServerSettingsChk.php` file. It allows arbitrary command execution as the web server user by injecting commands through the `rootUname` parameter.