CVE-2019-16662: OS Command Injection
An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue in rConfig 3.9.2?
The vulnerability ID for this issue in rConfig 3.9.2 is CVE-2019-16662.
What is the severity of CVE-2019-16662?
The severity of CVE-2019-16662 is critical with a CVSS score of 9.8.
How can an attacker exploit CVE-2019-16662?
An attacker can exploit CVE-2019-16662 by sending a GET request to ajaxServerSettingsChk.php with a malicious rootUname parameter, which allows for direct execution of system commands.
How can I mitigate the risk of CVE-2019-16662 in rConfig 3.9.2?
To mitigate the risk of CVE-2019-16662, it is recommended to update rConfig to a version that is not affected by this vulnerability and apply any patches or fixes provided by the vendor.
Are there any additional references related to CVE-2019-16662?
Yes, additional references related to CVE-2019-16662 can be found at the following URLs: [URL 1], [URL 2], [URL 3]