漏洞描述
lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
engindemirbilek.github.iohttps://engindemirbilek.github.io/rconfig-3.93-rce↗packetstormsecurity.comhttp://packetstormsecurity.com/files/156687/rConfig-3.93-Authenticated-Remote-Code-Execution.html↗github.comhttps://github.com/EnginDemirbilek/EnginDemirbilek.github.io/blob/master/rconfig-3.93-rce.html↗cwe.mitre.orghttps://cwe.mitre.org/data/definitions/78.html↗