.. / CVE-2020-12256

• XSS
• Nuclei
• Web

Exploit for rConfig 3.9.4 - Cross-Site Scripting (CVE-2020-12256)

Description:

The rConfig 3.9.4 is vulnerable to cross-site scripting. The devicemgmnt.php file improperly validates the request coming from the user input. Due to this flaw, An attacker can exploit this vulnerability by crafting arbitrary javascript in deviceId GET parameter of devicemgmnt.php resulting in execution of the javascript.

Nuclei Template

View the template here CVE-2020-12256.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2020/CVE-2020-12256.yaml

References: