rConfig 3.9.6 is affected by SQL Injection. A user must be authenticated to exploit the vulnerability. If --secure-file-priv in MySQL server is not set and the Mysql server is the same as rConfig, an attacker may successfully upload a webshell to the server and access it remotely.
References
| Link | Resource |
|---|---|
| http://rconfig.com | Vendor Advisory |
| https://github.com/mrojz/rconfig-exploit/blob/main/CVE-2021-29004-POC-req.txt | Third Party Advisory |
| https://github.com/mrojz/rconfig-exploit/blob/main/README.md | Third Party Advisory |
| https://rconfig.com | Vendor Advisory |
| http://rconfig.com | Vendor Advisory |
| https://github.com/mrojz/rconfig-exploit/blob/main/CVE-2021-29004-POC-req.txt | Third Party Advisory |
| https://github.com/mrojz/rconfig-exploit/blob/main/README.md | Third Party Advisory |
| https://rconfig.com | Vendor Advisory |
Configurations
History
21 Nov 2024, 06:00
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://rconfig.com - Vendor Advisory | |
| References | () https://github.com/mrojz/rconfig-exploit/blob/main/CVE-2021-29004-POC-req.txt - Third Party Advisory | |
| References | () https://github.com/mrojz/rconfig-exploit/blob/main/README.md - Third Party Advisory | |
| References | () https://rconfig.com - Vendor Advisory |
Information
Published : 2021-10-11 12:15
Updated : 2024-11-21 06:00
NVD link : CVE-2021-29004
Mitre link : CVE-2021-29004
CVE.ORG link : CVE-2021-29004
JSON object : View
Products Affected
rconfig
- rconfig
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')