CVE-2020-13778

Name of the Vulnerable Software and Affected Versions rConfig versions 3.9.4 and earlier

Description The issue allows authenticated code execution of system commands by sending a forged GET request to specific API endpoints, such as "lib/ajaxHandlers/ajaxAddTemplate.php" or "lib/ajaxHandlers/ajaxEditTemplate.php".

Recommendations For versions 3.9.4 and earlier, consider disabling access to the "lib/ajaxHandlers/ajaxAddTemplate.php" and "lib/ajaxHandlers/ajaxEditTemplate.php" API endpoints until a patch is available. Restrict authenticated users' ability to send forged GET requests to these endpoints to minimize the risk of exploitation.