CVE-2020-10549 — AI Deep Analysis Summary

🚨 **Essence**: rConfig suffers from **SQL Injection (SQLi)** in `snippets.inc.php`.…

🛡️ **Root Cause**: **CWE-89 (SQL Injection)**. The flaw stems from **unauthenticated** input handling in `snippets.inc.php`. Additionally, passwords are stored in **cleartext** by default, exacerbating the risk.

📦 **Affected**: **rConfig** (Open-source network config management). 📅 **Version**: **3.9.4 and prior**. Any instance running these versions is vulnerable.

🕵️ **Attacker Capabilities**: Gain **unauthenticated** access to sensitive data. Specifically, retrieve **node passwords** in cleartext.…

⚡ **Exploitation Threshold**: **LOW**. The SQLi is **unauthenticated**. No login or special configuration is needed to trigger the vulnerability. It is easily exploitable by anyone with network access.

💣 **Public Exploit**: **YES**. 📂 **PoC Available**: GitHub repos (e.g., `nuclei-templates`, `theguly/exploits`) contain YAML and Python scripts.…

🔍 **Self-Check**: Scan for rConfig instances. Use tools like **Nuclei** with the specific CVE template. Look for the `snippets.inc.php` endpoint. Check if the application version is **≤ 3.9.4**.

🩹 **Official Fix**: The data implies a fix exists for versions **> 3.9.4**. Users should **upgrade** to the latest version immediately. The core issue is the cleartext storage + SQLi, so patching addresses both.

🚧 **No Patch Workaround**: If you cannot upgrade: 1. **Block** external access to the rConfig web interface. 2. **Encrypt** node passwords if the system allows configuration changes. 3.…

🔥 **Urgency**: **HIGH**. Since it is **unauthenticated** and leads to **cleartext credential theft** and **lateral movement**, it is critical. Patch immediately to prevent network compromise.