CVE-2019-16663
HIGHrconfig 3.9.2 - OS Command Injection via catCommand Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2019-16663. PoCs published by mhaskar.
AI-analyzed exploit summary This repository contains a functional Python exploit for CVE-2019-16663, an authenticated remote code execution vulnerability in rConfig v3.9.2. The exploit leverages command injection via the 'searchTerm' parameter in the search.crud.php endpoint to execute arbitrary commands, resulting in a reverse shell.
Description
An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to search.crud.php because the catCommand parameter is passed to the exec function without filtering, which can lead to command execution.
Exploits (1)
This repository contains a functional Python exploit for CVE-2019-16663, an authenticated remote code execution vulnerability in rConfig v3.9.2. The exploit leverages command injection via the 'searchTerm' parameter in the search.crud.php endpoint to execute arbitrary commands, resulting in a reverse shell.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H