CVE-2019-19509: OS Command Injection
An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php because the path parameter is passed to the exec function without filtering, which can lead to command execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-19509?
The severity of CVE-2019-19509 is critical with a CVSS score of 8.8.
How can a remote authenticated user exploit CVE-2019-19509?
A remote authenticated user can exploit CVE-2019-19509 by sending a GET request to ajaxArchiveFiles.php with a specially crafted path parameter to execute arbitrary system commands.
What is the affected software version of CVE-2019-19509?
The affected software version of CVE-2019-19509 is rConfig 3.9.3.
Is there a fix available for CVE-2019-19509?
Yes, there are fixes available for CVE-2019-19509. It is recommended to update to a patched version of rConfig.
Is there any additional information about CVE-2019-19509?
Yes, additional information about CVE-2019-19509 can be found in the provided references.