CVE-2020-10220
CRITICAL NUCLEIRconfig 3.x Chained Remote Code Execution
Title source: metasploitExploitation Summary
EIP tracks 4 public exploits for CVE-2020-10220.
PoCs published by Metasploit, vikingfr, CSpanias, including Metasploit module exploits/linux/http/rconfig_ajaxarchivefiles_rce.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits CVE-2020-10220 and CVE-2019-19509 in rConfig 3.9.x, chaining SQL injection for authentication bypass and command injection for remote code execution. It automates the creation of an admin user, authentication, payload execution, and cleanup.
Description
An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter.
Exploits (4)
This Metasploit module exploits CVE-2020-10220 and CVE-2019-19509 in rConfig 3.9.x, chaining SQL injection for authentication bypass and command injection for remote code execution. It automates the creation of an admin user, authentication, payload execution, and cleanup.
This exploit demonstrates a SQL injection vulnerability in rConfig 3.9 via the 'searchColumn' parameter in 'commands.inc.php'. It extracts database names, user credentials, and device information using UNION-based SQLi techniques.
This PoC combines SQL injection and command injection to exploit rConfig 3.9.4, extracting database credentials, cracking hashes via hashcat, and optionally triggering a reverse shell.
This Metasploit module exploits CVE-2020-10220 and CVE-2019-19509 in rConfig 3.9.x, chaining SQL injection for authentication bypass and command injection for remote code execution. It creates a temporary admin user, authenticates, executes payloads, and cleans up by removing the user.
Nuclei Templates (1)
title:"rConfig" || http.title:"rconfig"
title="rconfig"
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H