Vulnerability Details : CVE-2019-19509

Public exploit exists!
An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php because the path parameter is passed to the exec function without filtering, which can lead to command execution.
Published 2020-01-06 20:15:12
Updated 2023-01-31 20:39:30
Source MITRE
View at NVD,   CVE.org

Products affected by CVE-2019-19509

Exploit prediction scoring system (EPSS) score for CVE-2019-19509

EPSS FAQ
91.92%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2019-19509

  • Rconfig 3.x Chained Remote Code Execution
    Disclosure Date: 2020-03-11
    First seen: 2020-04-26
    exploit/linux/http/rconfig_ajaxarchivefiles_rce
    This module exploits multiple vulnerabilities in rConfig version 3.9 in order to execute arbitrary commands. This module takes advantage of a command injection vulnerability in the `path` parameter of the ajax archive file functionality within the rConfig web

CVSS scores for CVE-2019-19509

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
9.0
 HIGH AV:N/AC:L/Au:S/C:C/I:C/A:C
8.0
10.0
 NIST
8.8
 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
2.8
5.9
 NIST

CWE ids for CVE-2019-19509

References for CVE-2019-19509

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close