CVE-2019-19509

CVE-2019-19509 describes an authenticated remote command execution vulnerability in rConfig 3.9.3. A remote, authenticated attacker can execute arbitrary system commands by manipulating the 'path' parameter in a GET request to ajaxArchiveFiles.php, which is then passed unfiltered to the 'exec' function. This vulnerability carries a high CVSS score of 8.8, indicating severe impacts on confidentiality, integrity, and availability. Exploit intelligence shows readily available exploit modules in Metasploit and ExploitDB, and it has been observed in the wild as part of the Gitpaste-12 worm botnet, confirming active exploitation.