CVE-2021-29004
HighCVSS 8.8Exploitation Probability (EPSS)
High risk79th percentile - higher than 79% of all known CVEs
Summary
SQL Injection vulnerability in rConfig 3.9.6 allows an authenticated attacker to inject malicious SQL code. If the MySQL server does not have --secure-file-priv set and is on the same host as rConfig, the attacker can upload a webshell and gain remote access.
Risk Assessment
The risk includes full server compromise, potentially leading to data theft, configuration changes, or further attacks on the infrastructure.
Recommendation
Immediately update rConfig to the latest version and configure the --secure-file-priv option in MySQL to restrict file write capabilities via SQL queries.
Other vulnerabilities in rConfig
See all- CVE-2021-29006Medium
rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any file on the server.
- CVE-2026-64826Medium
rConfig before 8.2.13 has a path traversal vulnerability in the download_export() method, allowing authenticated attackers to read arbitrary files by supplying ../ sequences in the filename parameter. Sensitive files like environment files with encryption keys, database credentials, and mail config can be accessed.
- CVE-2023-39110High
rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.
- CVE-2023-39109High
rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.
- CVE-2023-39108High
In version 3.9.4 of rconfig, a Server-Side Request Forgery (SSRF) vulnerability was discovered in the path_b parameter of the doDiff function in /classes/compareClass.php. This allows authenticated attackers to make arbitrary requests by injecting crafted URLs.
- CVE-2021-29005High
In rConfig 3.9.6, insecure permissions for the chmod command exist. After installation, the apache user can execute chmod as root without a password, allowing a low-privilege attacker to gain root access to the server.
Original NVD description (English source)
rConfig 3.9.6 is affected by SQL Injection. A user must be authenticated to exploit the vulnerability. If --secure-file-priv in MySQL server is not set and the Mysql server is the same as rConfig, an attacker may successfully upload a webshell to the server and access it remotely.