CVE-2019-19509
HIGH EXPLOITED IN THE WILDrConfig 3.9.3 - Authenticated OS Command Injection via ajaxArchiveFiles.php Path Parameter
Title source: llmExploitation Summary
CVE-2019-19509 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).
EIP tracks 3 public exploits from researchers including vikingfr, Jean-Pascal Thomas, Orange Cyberdefense, including a Metasploit module exploits/linux/http/rconfig_ajaxarchivefiles_rce.
AI-analyzed exploit summary This exploit leverages an authenticated remote code execution vulnerability in rConfig 3.9.3 by injecting a reverse shell payload via the `path` parameter in an AJAX handler. It requires valid credentials and triggers a bash reverse shell to a specified IP and port.
Description
An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php because the path parameter is passed to the exec function without filtering, which can lead to command execution.
Exploits (3)
This exploit leverages an authenticated remote code execution vulnerability in rConfig 3.9.3 by injecting a reverse shell payload via the `path` parameter in an AJAX handler. It requires valid credentials and triggers a bash reverse shell to a specified IP and port.
This Metasploit module exploits CVE-2019-19509, a command injection vulnerability in rConfig 3.9, by chaining it with an SQL injection (CVE-2020-10220) to bypass authentication. It creates an admin user, authenticates, and executes arbitrary commands via the `path` parameter in `ajaxArchiveFiles.php`.
This Metasploit module exploits CVE-2019-19509, a command injection vulnerability in rConfig 3.9, by chaining it with an SQL injection (CVE-2020-10220) to bypass authentication. It creates an admin user, authenticates, executes arbitrary commands via the `path` parameter in `ajaxArchiveFiles.php`, and cleans up by removing the added user.
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H