Farid007

The issue is related to cross-site request forgery (CSRF) via the "admin/pages/delete/" URI, which can lead to the deletion of pages.

The issue allows for cross-site request forgery (CSRF) via the "admin/addons/uninstall/anomaly.module.blocks" URI, which can lead to the deletion of an arbitrary plugin.

The issue allows for Remote Command Execution due to improper escaping of shell metacharacters from a POST request in System-Snapshot.php. An attacker can exploit this by sending a crafted payload containing shell metacharacters via a POST request with the `psw` parameter. This can also be exploited through Cross-Site Request Forgery (CSRF).

The issue arises from an incorrect implementation of the `sanitize()` function in `inc/libmisc.php`, which attempts to escape the SCRIPT tag from user-controllable values but can be bypassed. This can be demonstrated using an `onerror` attribute of an `IMG` element as a `Devices-Config.php?sta=` value.

The issue allows for Remote Command Execution due to improper escaping of shell metacharacters from a POST request in the pwsec.php file. An attacker can exploit this by sending a crafted payload containing shell metacharacters via a POST request with the `pw` parameter. This can also be exploited through Cross-Site Request Forgery (CSRF).

🚨 CVE-2020-12258 rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are mishandled. The application can reuse a session via PHPSESSID. Also, an attacker can exploit this vulnerability in conjunction with CVE-2020-12256 or CVE-2020-12259. 🎖@cveNotify

The issue concerns improper validation of user input in the devicemgmnt.php file, allowing for reflected XSS attacks. An attacker can exploit this by crafting arbitrary JavaScript in the `deviceId` GET parameter to the "devicemgmnt.php" endpoint.

The issue concerns improper validation of user input in the configDevice.php file, allowing for reflected XSS attacks. An attacker can exploit this by crafting arbitrary JavaScript in the `rid` GET parameter of the "devicemgmnt.php" endpoint.

The issue is related to remote code execution due to improper validation in the file upload functionality. Specifically, `vendor.crud.php` accepts file uploads by checking the `content-type` without considering the file extension and header. This allows an attacker to exploit the vulnerability by uploading a `.php` file to `vendor.php` that contains arbitrary PHP code and changing the `content-type` to `image/gif`.