What’s Vulnerable › Vulnerabilities

CVE-2019-19509

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 71.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-01-06 · updated 2026-06-17
• Weakness: CWE-78

Description

An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php because the path parameter is passed to the exec function without filtering, which can lead to command execution.

Affected products

• rconfig: 3.9.3

References

• http://packetstormsecurity.com/files/156146/rConfig-3.9.3-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/156766/Rconfig-3.x-Chained-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/156950/rConfig-3.9.4-searchField-Remote-Code-Execution.html
• https://github.com/v1k1ngfr
• https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_CVE-2019-19509.py
• https://raw.githubusercontent.com/v1k1ngfr/exploits/master/rconfig_exploit.py?token=
• http://packetstormsecurity.com/files/156146/rConfig-3.9.3-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/156766/Rconfig-3.x-Chained-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/156950/rConfig-3.9.4-searchField-Remote-Code-Execution.html
• https://github.com/v1k1ngfr
• https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_CVE-2019-19509.py
• https://raw.githubusercontent.com/v1k1ngfr/exploits/master/rconfig_exploit.py?token=

Get alerted when CVE-2019-19509 or the next vulnerability affects your stack