CVE-2020-10220

This Metasploit module exploits CVE-2020-10220 and CVE-2019-19509 in rConfig 3.9.x, chaining SQL injection for authentication bypass and command injection for remote code execution. It automates the creation of an admin user, authentication, payload execution, and cleanup.

This exploit demonstrates a SQL injection vulnerability in rConfig 3.9 via the 'searchColumn' parameter in 'commands.inc.php'. It extracts database names, user credentials, and device information using UNION-based SQLi techniques.

This PoC combines SQL injection and command injection to exploit rConfig 3.9.4, extracting database credentials, cracking hashes via hashcat, and optionally triggering a reverse shell.

This Metasploit module exploits CVE-2020-10220 and CVE-2019-19509 in rConfig 3.9.x, chaining SQL injection for authentication bypass and command injection for remote code execution. It creates a temporary admin user, authenticates, executes payloads, and cleans up by removing the user.