https://pwnwiki.com/index.php?action=history&feed=atom&title=RConfig_3.9.6_%E6%9C%AC%E5%9C%B0%E6%96%87%E4%BB%B6%E5%8C%85%E5%90%AB%E6%BC%8F%E6%B4%9E 2026-04-21T01:54:38Z Revision history for this page on the wiki MediaWiki 1.35.1 https://pwnwiki.com/index.php?title=RConfig_3.9.6_%E6%9C%AC%E5%9C%B0%E6%96%87%E4%BB%B6%E5%8C%85%E5%90%AB%E6%BC%8F%E6%B4%9E&diff=1255&oldid=prev 2021-04-08T09:14:26Z

<p>Created page with &quot;==EXP== &lt;pre&gt; # Exploit Title: rConfig 3.9.6 - &#039;path&#039; Local File Inclusion (Authenticated) # Date: 2021-03-12 # Exploit Author: 5a65726f # Vendor Homepage: https://www.rconfig...&quot;</p> <p><b>New page</b></p><div>==EXP==<br /> &lt;pre&gt;<br /> # Exploit Title: rConfig 3.9.6 - 'path' Local File Inclusion (Authenticated)<br /> # Date: 2021-03-12<br /> # Exploit Author: 5a65726f<br /> # Vendor Homepage: https://www.rconfig.com<br /> # Software Link: https://www.rconfig.com/downloads/rconfig-3.9.6.zip<br /> # Version: rConfig v3.9.6<br /> # Install scripts :<br /> # https://www.rconfig.com/downloads/scripts/install_rConfig.sh<br /> # https://www.rconfig.com/downloads/scripts/centos7_install.sh<br /> # https://www.rconfig.com/downloads/scripts/centos6_install.sh<br /> # Tested on: centOS 7<br /> # Notes : If you want to reproduce in your lab environment follow those links :<br /> # http://help.rconfig.com/gettingstarted/installation<br /> # then<br /> # http://help.rconfig.com/gettingstarted/postinstall<br /> <br /> # Description:<br /> rConfig, the open source network device configuration management tool, is vulnerable to local file inclusion in /lib/ajaxHandlers/ajaxGetFileByPath.php with parameter path. ajaxGetFileByPath.php allows authenticated users to download any file on the server.<br /> <br /> The following steps can be carried out in duplicating this vulnerability.<br /> <br /> - Login the rConfig application with your credentials.<br /> - Enter the following link to your browser: <br /> http(s)://&lt;SERVER&gt;/lib/ajaxHandlers/ajaxGetFileByPath.php?path=../../../../../../etc/passwd<br /> <br /> &lt;/pre&gt;</div>

Pwnwiki