CVE-2021-29004

rConfig 3.9.6 is affected by SQL Injection

published October 11, 2021

CVSS
—
EPSS
2%
Percentile
81.6
In the wild
Unconfirmed
What it is

rConfig 3.9.6 is affected by SQL Injection. A user must be authenticated to exploit the vulnerability. If --secure-file-priv in MySQL server is not set and the Mysql server is the same as rConfig, an attacker may successfully upload a webshell to the server and access it remotely.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02100 · 81.6th percentile
Published
2021-10-11T11:58Z
EPSS history
Timeline
  • 11 OCT 11:58Z
    rConfig 3.9.6 is affected by SQL Injection
    cvelistv5