CVE-2020-23150
📋 TL;DR
This SQL injection vulnerability in rConfig 3.9.5 allows attackers to execute arbitrary SQL commands via crafted GET requests to the ajaxDbInstall.php endpoint. This can lead to unauthorized access to sensitive database information including credentials and configuration data. All systems running the vulnerable version with the installation component accessible are affected.
💻 Affected Systems
- rConfig
📦 What is this software?
Rconfig by Rconfig
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to credential theft, data exfiltration, and potential lateral movement to other systems.
Likely Case
Extraction of database credentials and configuration data, enabling further system compromise.
If Mitigated
Limited impact with proper network segmentation and access controls preventing exploitation.
🎯 Exploit Status
Simple SQL injection requiring only web access to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.9.6 or later
Vendor Advisory: https://github.com/rconfig/rconfig/releases
Restart Required: No
Instructions:
1. Upgrade to rConfig 3.9.6 or later. 2. Remove the /install/ directory if no longer needed. 3. Review and secure database credentials.
🔧 Temporary Workarounds
Remove installation directory
linuxDelete the installation component after setup to eliminate the vulnerable endpoint.
rm -rf /path/to/rconfig/www/install/
Web server access restriction
allBlock access to the vulnerable endpoint using web server configuration.
# Apache: <Location "/install/"> Require all denied </Location>
# Nginx: location /install/ { deny all; }
🧯 If You Can't Patch
- Implement strict network access controls to block external access to the installation endpoint.
- Monitor for SQL injection attempts and unauthorized database access patterns.
🔍 How to Verify
Check if Vulnerable:
Check if /install/lib/ajaxHandlers/ajaxDbInstall.php exists and is accessible via web.Check Version:
grep -r 'version' /path/to/rconfig/www/install/install.php 2>/dev/null || echo 'Install directory removed'Verify Fix Applied:
Confirm the file no longer exists or returns access denied, and verify rConfig version is 3.9.6+.📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests to /install/lib/ajaxHandlers/ajaxDbInstall.php with SQL syntax in parameters
- Database error logs showing unexpected queries from web application
Network Indicators:
- HTTP traffic to installation endpoints post-setup
- SQL injection patterns in web requests
SIEM Query:
source="web_logs" AND uri="/install/lib/ajaxHandlers/ajaxDbInstall.php" AND (method="GET" OR params CONTAINS "SELECT" OR params CONTAINS "UNION")