CVE-2020-10221

HIGHCISA KEV

rConfig OS Command Injection Vulnerability

Title source: CISA
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2020-10221 has a selected CVSS score of 8.8 (high); EIP currently links 1 catalogued exploit. CISA lists CVE-2020-10221 in KEV.

Description

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter.

Description source: CVE List

Exploitation context

Known exploitation

CISA KEV
Listed · Nov 3, 2021 · CISA
VulnCheck KEV
Listed · Nov 3, 2021 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationActive
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 4, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

rConfig

Browse rConfig / rConfig
CISAVersion data not supplied

Proofs of concept

1

Catalogued exploits

ExploitDBrConfig 3.93 - 'ajaxAddTemplate.php' Authenticated Remote Code ExecutionExploitDB exploitby Engin DemirbilekNot analyzed1 file
ExploitDB
PoC details

References

6