Rconfig

SSRF in Rconfig 3.9.4 via path_b in compareClass.php
CVE-2023-39108 8.8 - High - August 01, 2023

rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_b parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.

SSRF

rConfig 3.9.4 SSRF via path_a (compareClass.php)
CVE-2023-39109 8.8 - High - August 01, 2023

rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.

SSRF

SSRF in rconfig v3.9.4 via /ajaxGetFileByPath.php
CVE-2023-39110 8.8 - High - August 01, 2023

rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.

SSRF

SQL Injection in rConfig 3.9.7 via ajaxCompareGetCmdDates.php
CVE-2022-45030 8.8 - High - April 15, 2023

A SQL injection vulnerability in rConfig 3.9.7 exists via lib/ajaxHandlers/ajaxCompareGetCmdDates.php?command= (this may interact with secure-file-priv).

SQL Injection

Arbitrary file download via crafted request in rConfig 6.8.0
CVE-2023-24366 6.5 - Medium - March 27, 2023

An arbitrary file download vulnerability in rConfig v6.8.0 allows attackers to download sensitive files via a crafted HTTP request.

rconfig v3.9.6 Arbitrary File Upload via PHP Script
CVE-2022-44384 8.8 - High - November 17, 2022

An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file.

Unrestricted File Upload

Insecure permission of chmod command on rConfig server 3.9.6 exists
CVE-2021-29005 8.8 - High - October 11, 2021

Insecure permission of chmod command on rConfig server 3.9.6 exists. After installing rConfig apache user may execute chmod as root without password which may let an attacker with low privilege to gain root access on server.

Incorrect Default Permissions

rConfig 3.9.6 is affected by a Local File Disclosure vulnerability
CVE-2021-29006 6.5 - Medium - October 11, 2021

rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any file on the server.

Information Disclosure

rConfig 3.9.6 is affected by SQL Injection
CVE-2021-29004 8.8 - High - October 11, 2021

rConfig 3.9.6 is affected by SQL Injection. A user must be authenticated to exploit the vulnerability. If --secure-file-priv in MySQL server is not set and the Mysql server is the same as rConfig, an attacker may successfully upload a webshell to the server and access it remotely.

SQL Injection

An arbitrary file deletion vulnerability in rConfig 3.9.5 has been fixed for 3.9.6
CVE-2020-25359 9.1 - Critical - August 20, 2021

An arbitrary file deletion vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability gave attackers the ability to send a crafted request to /lib/ajaxHandlers/ajaxDeleteAllLoggingFiles.php by specifying a path in the path parameter and an extension in the ext parameter and delete all the files with that extension in that path.

AuthZ

An insecure update feature in the /updater.php component of rConfig 3.9.6 and below
CVE-2020-27464 7.8 - High - August 20, 2021

An insecure update feature in the /updater.php component of rConfig 3.9.6 and below allows attackers to execute arbitrary code via a crafted ZIP file.

AuthZ

A stored cross-site scripting (XSS) vulnerability in the /devices.php function inrConfig 3.9.5 has been fixed for version 3.9.6
CVE-2020-25352 5.4 - Medium - August 20, 2021

A stored cross-site scripting (XSS) vulnerability in the /devices.php function inrConfig 3.9.5 has been fixed for version 3.9.6. This vulnerability allowed remote attackers to perform arbitrary Javascript execution through entering a crafted payload into the 'Model' field then saving.

XSS

An information disclosure vulnerability in rConfig 3.9.5 has been fixed for version 3.9.6
CVE-2020-25351 6.5 - Medium - August 20, 2021

An information disclosure vulnerability in rConfig 3.9.5 has been fixed for version 3.9.6. This vulnerability allowed remote authenticated attackers to read files on the system via a crafted request sent to to the /lib/crud/configcompare.crud.php script.

Files or Directories Accessible to External Parties

An arbitrary file write vulnerability in lib/AjaxHandlers/ajaxEditTemplate.php of rConfig 3.9.6
CVE-2020-27466 7.8 - High - August 20, 2021

An arbitrary file write vulnerability in lib/AjaxHandlers/ajaxEditTemplate.php of rConfig 3.9.6 allows attackers to execute arbitrary code via a crafted file.

AuthZ

A server-side request forgery (SSRF) vulnerability in rConfig 3.9.5 has been fixed for 3.9.6
CVE-2020-25353 6.5 - Medium - August 20, 2021

A server-side request forgery (SSRF) vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability allowed remote authenticated attackers to open a connection to the machine via the deviceIpAddr and connPort parameters.

SSRF

The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized
CVE-2020-23148 7.5 - High - August 09, 2021

The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via a crafted POST request.

Injection

The dbName parameter in ajaxDbInstall.php of rConfig 3.9.5 is unsanitized
CVE-2020-23149 7.5 - High - August 09, 2021

The dbName parameter in ajaxDbInstall.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a SQL injection and access sensitive database information.

SQL Injection

A SQL injection vulnerability in config.inc.php of rConfig 3.9.5
CVE-2020-23150 7.5 - High - August 09, 2021

A SQL injection vulnerability in config.inc.php of rConfig 3.9.5 allows attackers to access sensitive database information via a crafted GET request to install/lib/ajaxHandlers/ajaxDbInstall.php.

SQL Injection

rConfig 3.9.5 allows command injection by sending a crafted GET request to lib/ajaxHandlers/ajaxArchiveFiles.php since the path parameter is passed directly to the exec function without being escaped.
CVE-2020-23151 9.8 - Critical - August 09, 2021

rConfig 3.9.5 allows command injection by sending a crafted GET request to lib/ajaxHandlers/ajaxArchiveFiles.php since the path parameter is passed directly to the exec function without being escaped.

Shell injection

lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation
CVE-2020-13638 9.8 - Critical - November 13, 2020

lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation. This issue has been fixed in 3.9.7.

authentification

rConfig 3.9.4 and earlier
CVE-2020-13778 8.8 - High - October 19, 2020

rConfig 3.9.4 and earlier allows authenticated code execution (of system commands) by sending a forged GET request to lib/ajaxHandlers/ajaxAddTemplate.php or lib/ajaxHandlers/ajaxEditTemplate.php.

Shell injection

rConfig 3.9.5 is vulnerable to SQL injection
CVE-2020-15713 8.8 - High - July 28, 2020

rConfig 3.9.5 is vulnerable to SQL injection. A remote authenticated attacker could send crafted SQL statements to the devices.php script using the sortBy parameter, which could allow the attacker to view, add, modify, or delete information in the back-end database.

SQL Injection

rConfig 3.9.5 could
CVE-2020-15715 9.9 - Critical - July 28, 2020

rConfig 3.9.5 could allow a remote authenticated attacker to execute arbitrary code on the system, because of an error in the search.crud.php script. An attacker could exploit this vulnerability using the nodeId parameter.

rConfig 3.9.5 is vulnerable to SQL injection
CVE-2020-15714 8.8 - High - July 28, 2020

rConfig 3.9.5 is vulnerable to SQL injection. A remote authenticated attacker could send crafted SQL statements to the devices.crud.php script using the custom_Location parameter, which could allow the attacker to view, add, modify, or delete information in the back-end database.

SQL Injection

rConfig 3.9.5 could allow a remote authenticated attacker to traverse directories on the system
CVE-2020-15712 4.3 - Medium - July 28, 2020

rConfig 3.9.5 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a crafted request to the ajaxGetFileByPath.php script containing hexadecimal encoded "dot dot" sequences (%2f..%2f) in the path parameter to view arbitrary files on the system.

Directory traversal

rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection
CVE-2020-10549 9.8 - Critical - June 04, 2020

rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.

SQL Injection

rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection
CVE-2020-10548 9.8 - Critical - June 04, 2020

rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.

SQL Injection

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection
CVE-2020-10547 9.8 - Critical - June 04, 2020

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.

SQL Injection

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection
CVE-2020-10546 9.8 - Critical - June 04, 2020

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.

SQL Injection

rConfig 3.9.4 is vulnerable to reflected XSS
CVE-2020-12256 - May 18, 2020

rConfig 3.9.4 is vulnerable to reflected XSS. The devicemgmnt.php file improperly validates user input. An attacker can exploit this by crafting arbitrary JavaScript in the deviceId GET parameter to devicemgmnt.php.

rConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file upload functionality
CVE-2020-12255 - May 18, 2020

rConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file upload functionality. vendor.crud.php accepts a file upload by checking content-type without considering the file extension and header. Thus, an attacker can exploit this by uploading a .php file to vendor.php that contains arbitrary PHP code and changing the content-type to image/gif.

rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are mishandled
CVE-2020-12258 - May 18, 2020

rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are mishandled. The application can reuse a session via PHPSESSID. Also, an attacker can exploit this vulnerability in conjunction with CVE-2020-12256 or CVE-2020-12259.

rConfig 3.9.4 is vulnerable to cross-site request forgery (CSRF) because it lacks implementation of CSRF protection such as a CSRF token
CVE-2020-12257 - May 18, 2020

rConfig 3.9.4 is vulnerable to cross-site request forgery (CSRF) because it lacks implementation of CSRF protection such as a CSRF token. An attacker can leverage this vulnerability by creating a form (add a user, delete a user, or edit a user).

rConfig 3.9.4 is vulnerable to reflected XSS
CVE-2020-12259 - May 18, 2020

rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php.

rConfig before 3.9.5
CVE-2020-10879 - March 23, 2020

rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped.

An issue was discovered in includes/head.inc.php in rConfig before 3.9.4
CVE-2020-9425 - March 20, 2020

An issue was discovered in includes/head.inc.php in rConfig before 3.9.4. An unauthenticated attacker can retrieve saved cleartext credentials via a GET request to settings.php. Because the application was not exiting after a redirect is applied, the rest of the page still executed, resulting in the disclosure of cleartext credentials in the response.

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94
CVE-2020-10221 8.8 - High - March 08, 2020

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter.

Shell injection

An issue was discovered in rConfig through 3.9.4
CVE-2020-10220 9.8 - Critical - March 07, 2020

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter.

SQL Injection

An issue was discovered in rConfig 3.9.3
CVE-2019-19585 - January 06, 2020

An issue was discovered in rConfig 3.9.3. The install script updates the /etc/sudoers file for rconfig specific tasks. After an "rConfig specific Apache configuration" update, apache has high privileges for some binaries. This can be exploited by an attacker to bypass local security restrictions.

An issue was discovered in rConfig 3.9.3
CVE-2019-19509 - January 06, 2020

An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php because the path parameter is passed to the exec function without filtering, which can lead to command execution.

A downloadFile.php download_file path traversal vulnerability in rConfig through 3.9.3
CVE-2019-19372 - November 28, 2019

A downloadFile.php download_file path traversal vulnerability in rConfig through 3.9.3 allows attackers to list files in arbitrary folders and potentially download files. NOTE: the discoverer later reported that there was not a "fully working exploit.

rConfig 3.9.2 allows devices.php?searchColumn= SQL injection.
CVE-2019-19207 - November 21, 2019

rConfig 3.9.2 allows devices.php?searchColumn= SQL injection.

An issue was discovered in rConfig 3.9.2
CVE-2019-16663 8.8 - High - October 28, 2019

An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to search.crud.php because the catCommand parameter is passed to the exec function without filtering, which can lead to command execution.

Shell injection

An issue was discovered in rConfig 3.9.2
CVE-2019-16662 9.8 - Critical - October 28, 2019

An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution.

Shell injection