Description (CNA)
rConfig 3.9.4 and earlier allows authenticated code execution (of system commands) by sending a forged GET request to lib/ajaxHandlers/ajaxAddTemplate.php or lib/ajaxHandlers/ajaxEditTemplate.php.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- https://cxsecurity.com/issue/WLB-2020100091
- https://github.com/theguly/exploits/blob/master/CVE-2020-13778.py
- https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/
ADP enrichment
No English description supplied.