CVE-2019-19509

An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php because the path parameter is passed to the exec function without filtering, which can lead to command execution.

• CWE-78

• http://packetstormsecurity.com/files/156146/rConfig-3.9.3-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/156766/Rconfig-3.x-Chained-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/156950/rConfig-3.9.4-searchField-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/v1k1ngfrExploit, Third Party Advisory
• https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_CVE-2019-19509.pyExploit, Third Party Advisory
• https://raw.githubusercontent.com/v1k1ngfr/exploits/master/rconfig_exploit.py?token=Broken Link
• http://packetstormsecurity.com/files/156146/rConfig-3.9.3-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/156766/Rconfig-3.x-Chained-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/156950/rConfig-3.9.4-searchField-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/v1k1ngfrExploit, Third Party Advisory
• https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_CVE-2019-19509.pyExploit, Third Party Advisory
• https://raw.githubusercontent.com/v1k1ngfr/exploits/master/rconfig_exploit.py?token=Broken Link

Published

Jan 6, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-19500Matrix42 Workspace Management 9.1.2.2765 and below allows st…5.4
• CVE-2019-19501VeraCrypt 1.24 allows Local Privilege Escalation during exec…7.8
• CVE-2019-19502Code injection in pluginconfig.php in Image Uploader and Bro…9.8
• CVE-2019-19505Tenda PA6 Wi-Fi Powerline extender 1.0.1.21 is vulnerable to…8.8
• CVE-2019-19506Tenda PA6 Wi-Fi Powerline extender 1.0.1.21 is vulnerable to…7.5
• CVE-2019-19507In jpv (aka Json Pattern Validator) before 2.1.1, compareCom…5.3
• CVE-2019-1951A vulnerability in the packet filtering features of Cisco SD…5.8
• CVE-2019-19513The BASSMIDI plugin 2.4.12.1 for Un4seen BASS Audio Library …9.8
• CVE-2019-19514Ayision Ays-WR01 v28K.RPT.20161224 devices allow stored XSS …5.4
• CVE-2019-19515Ayision Ays-WR01 v28K.RPT.20161224 devices allow stored XSS …6.1
• CVE-2019-19516Intelbras WRN 150 1.0.18 devices allow CSRF via GO=system_pa…6.5
• CVE-2019-19517Intelbras RF1200 1.1.3 devices allow CSRF to bypass the logi…8.8