CVE-2019-19509

This exploit leverages an authenticated remote code execution vulnerability in rConfig 3.9.3 by injecting a reverse shell payload via the `path` parameter in an AJAX handler. It requires valid credentials and triggers a bash reverse shell to a specified IP and port.

This Metasploit module exploits CVE-2019-19509, a command injection vulnerability in rConfig 3.9, by chaining it with an SQL injection (CVE-2020-10220) to bypass authentication. It creates an admin user, authenticates, and executes arbitrary commands via the `path` parameter in `ajaxArchiveFiles.php`.

This Metasploit module exploits CVE-2019-19509, a command injection vulnerability in rConfig 3.9, by chaining it with an SQL injection (CVE-2020-10220) to bypass authentication. It creates an admin user, authenticates, executes arbitrary commands via the `path` parameter in `ajaxArchiveFiles.php`, and cleans up by removing the added user.