.. / CVE-2019-16662

• RCE
• Nuclei
• Web

Exploit for rConfig 3.9.2 - Remote Code Execution (CVE-2019-16662)

Description:

rConfig 3.9.2 is susceptible to a remote code execution vulnerability. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution.

Nuclei Template

View the template here CVE-2019-16662.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2019/CVE-2019-16662.yaml

References: