CVE-2020-15713 : Security Advisory and Response

rConfig 3.9.5 is vulnerable to SQL injection, potentially allowing remote attackers to manipulate the back-end database.

Understanding CVE-2020-15713

What is CVE-2020-15713?

rConfig 3.9.5 is susceptible to SQL injection, enabling authenticated remote attackers to execute malicious SQL commands through the devices.php script.

The Impact of CVE-2020-15713

The vulnerability could permit attackers to view, add, modify, or delete data within the database.

Technical Details of CVE-2020-15713

Vulnerability Description

The issue lies in the sortBy parameter of the devices.php script, allowing attackers to inject crafted SQL statements.

Affected Systems and Versions

Product: rConfig
Version: 3.9.5

Exploitation Mechanism

Attackers can exploit the vulnerability by sending specially crafted SQL statements through the sortBy parameter in the devices.php script.

Mitigation and Prevention

Immediate Steps to Take

Implement a firewall to restrict access to the devices.php script.
Regularly monitor and review database activities for any unauthorized changes.

Long-Term Security Practices

Conduct regular security assessments and penetration testing to identify and address vulnerabilities.
Educate users on secure coding practices to prevent SQL injection attacks.

Patching and Updates

Apply the latest patches and updates provided by rConfig to address the SQL injection vulnerability.