Sploitus

Exploit for OS Command Injection in Rconfig

CVE-2019-19509CVE-2019-19585CVE-2020-10220

githubexploit · 2019-12-02

Exploit Code

README12 lines
## https://sploitus.com/exploit?id=60B64F32-A958-5C92-8491-81A1A16BDCD5
# exploits
Three exploits for rconfig <= 3.9.4 :
```
CVE-2019-19509 : authenticated RCE
CVE-2019-19585 : Local Privilege Escalation (root)
CVE-2020-10220 : unauthenticated SQLi
rconfig_root_RCE_unauth.py : chaining the three CVEs above to get root reverse shell 
                              without authentication
rconfig_ajaxarchivefiles_rce.rb : Rconfig 3.x - Chained Remote Code Execution
                                  Metasploit Module (EDB : 48223)
```