CVE-2019-19509

An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php because the path parameter is passed to the exec function without filtering, which can lead to command execution.

Date published : 2020-01-06

http://packetstormsecurity.com/files/156146/rConfig-3.9.3-Remote-Code-Execution.html

http://packetstormsecurity.com/files/156766/Rconfig-3.x-Chained-Remote-Code-Execution.html