Unscored CVE-2021-29004 EUVD-2021-15650GHSA-pq7x-3cwv-pj9r

rConfig 3.9.6 is affected by SQL Injection. A user must be authenticated to exploit the vulnerability. If --secure-file-priv in MySQL serve…

Published Oct 11, 2021 · Updated Jul 9, 2026 · Assigned by mitre

Description

rConfig 3.9.6 is affected by SQL Injection. A user must be authenticated to exploit the vulnerability. If --secure-file-priv in MySQL server is not set and the Mysql server is the same as rConfig, an attacker may successfully upload a webshell to the server and access it remotely.

References

https://rconfig.com
https://github.com/mrojz/rconfig-exploit/blob/main/CVE-2021-29004-POC-req.txt
https://github.com/mrojz/rconfig-exploit/blob/main/README.md