Sploitus

CVE-2019-16662

12 known exploits for CVE-2019-16662

An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution.

Affected products
Rconfig
Rconfig
= 3.9.2
CVSS 2.0
10.0 HIGH
CVSS 3.1
9.8 CRITICAL
EPSS
97.7% (100th percentile)
Weakness
CWE-78
NVD status
Modified
Published
2019-10-28
CVE-2019-16662 at NVD
Authoritative description, scoring and affected products

12 known exploits for CVE-2019-16662

Proof-of-concept code and exploit modules indexed by Sploitus

CVE-2019-19268
2026-08-28 KitPloitKITPLOIT
CVE-2019-16663
2026-08-27 KitPloitKITPLOIT
CVE-2019-16662
2026-08-27 KitPloitKITPLOIT
Exploit for CVE-2019-19268
2019-11-25 TheCyberGeekGITHUB
rConfig - install Command Execution Exploit
2019-11-09 metasploitZDTRuby
rConfig - install Command Execution (Metasploit)
2019-11-08 MetasploitEXPLOITDBRuby
rConfig 3.9.2 Command Injection
2019-11-07 Brendan ColesPACKETSTORMRuby
rConfig 3.9.2 - Remote Code Execution Exploit
2019-10-29 AskarZDTPython
rConfig 3.9.2 - Remote Code Execution
2019-10-29 AskarEXPLOITPACKPython
rConfig 3.9.2 - Remote Code Execution
2019-10-29 AskarEXPLOITDBPython
rConfig 3.9.2 Remote Code Execution
2019-10-29 AskarPACKETSTORMPython
Immunity Canvas: RCONFIG_AJAXSERVER_RCE
2019-10-28 Immunity CanvasCANVAS