CVE-2022-44384

published 2022-11-17

CVE-2022-44384: An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file.

Priority P2 66 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

EXPLOIT

An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
rconfig	rconfig	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /lib/crud/vendors.crud.php↗

path images/vendor/.php↗

• → Monitor for PHP file uploads to the /lib/crud/vendors.crud.php endpoint on rConfig v3.9.6 instances, as this is the vulnerable upload handler exploited for RCE. ↗
• → Alert on HTTP GET/POST requests to paths matching `images/vendor/*.php`, which indicates an attacker triggering a previously uploaded PHP webshell/payload. ↗
• → Exploitation requires a privileged (authenticated) rConfig account; monitor for unusual authenticated sessions followed by file upload activity to vendors.crud.php. ↗

• · Exploitation is limited to authenticated attackers with a privileged rConfig account; unauthenticated exploitation is not indicated by available sources. ↗
• · Vulnerability is confirmed in rConfig v3.9.6 specifically; applicability to other versions is not stated in available sources. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434