CVE-2019-16663

Name of the Vulnerable Software and Affected Versions rConfig version 3.9.2

Description An issue allows an attacker to directly execute system commands by sending a GET request to "search.crud.php" because the catCommand parameter is passed to the exec function without filtering, which can lead to command execution.

Recommendations For rConfig version 3.9.2, as a temporary workaround, consider restricting access to the "search.crud.php" endpoint or filtering the catCommand parameter to prevent command execution until a patch is available.