SQL Injection Vulnerability in rConfig by Rconfig
CVE-2021-29004
8.8HIGH
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2021-29004?
rConfig version 3.9.6 is vulnerable to an SQL Injection attack that requires user authentication to exploit. If the MySQL server has the --secure-file-priv option unset and is co-located with the rConfig application, an attacker could potentially upload a web shell to the server, granting them remote access. This vulnerability highlights the importance of configuring MySQL security settings and ensuring that user authentication mechanisms are robust to prevent unauthorized exploitation.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.