Sploitus

CVE-2019-19509

13 known exploits for CVE-2019-19509

An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php because the path parameter is passed to the exec function without filtering, which can lead to command execution.

Affected products
Rconfig
Rconfig
= 3.9.3
Fix
Available
CVSS 2.0
9.0 HIGH
CVSS 3.1
8.8 HIGH
EPSS
71.6% (99th percentile)
Weakness
CWE-78
NVD status
Modified
Published
2020-01-06
CVE-2019-19509 at NVD
Authoritative description, scoring and affected products

13 known exploits for CVE-2019-19509

Proof-of-concept code and exploit modules indexed by Sploitus

exploits-rconfig
2026-08-27 KitPloitKITPLOIT
rConfig 3.9.4 - (searchField) Unauthenticated Root Remote Code Execution Exploit
2020-03-28 vikingfrZDT
rConfig 3.9.4 searchField Remote Code Execution
2020-03-28 vikingfrPACKETSTORM
rConfig 3.9.4 - searchField Unauthenticated Root Remote Code Execution
2020-03-27 vikingfrEXPLOITPACK
rConfig 3.9.4 - 'searchField' Unauthenticated Root Remote Code Execution
2020-03-27 vikingfrEXPLOITDB
Rconfig 3.x Chained Remote Code Execution Exploit
2020-03-17 metasploitZDTRuby
Rconfig 3.x - Chained Remote Code Execution (Metasploit)
2020-03-17 MetasploitEXPLOITDBRuby
Rconfig 3.x Chained Remote Code Execution
2020-03-16 Orange CyberdefensePACKETSTORMRuby
rConfig 3.9.3 - Authenticated Remote Code Execution Exploit
2020-01-30 vikingfrZDT
rConfig 3.9.3 - Authenticated Remote Code Execution
2020-01-30 vikingfrEXPLOITPACK
rConfig 3.9.3 - Authenticated Remote Code Execution
2020-01-30 vikingfrEXPLOITDB
rConfig 3.9.3 Remote Code Execution
2020-01-30 vikingfrPACKETSTORM
Exploit for OS Command Injection in Rconfig
2019-12-02 v1k1ngfrGITHUB