{"vulnerability": "CVE-2020-1022", "sightings": [{"uuid": "af2aae9f-4682-4e8f-9eae-c5c5ea5ca599", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10221", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "cc5eb71b-5fa8-4ace-9d09-03b6aea78517", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10221", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:19.000000Z"}, {"uuid": "cbd6af1d-17bb-4e30-b9ec-848ee88fec26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10220", "type": "exploited", "source": "https://www.exploit-db.com/exploits/48223", "content": "", "creation_timestamp": "2020-03-17T00:00:00.000000Z"}, {"uuid": "0077ebc4-8fac-4c82-b642-66353f51fd3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10221", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2970944", "content": "", "creation_timestamp": "2024-12-24T20:22:06.831628Z"}, {"uuid": "ef4c4f60-64b1-40da-b208-066e6c00b8cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10220", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "1431d9d2-3472-4fc0-ab22-33b13a061de9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10220", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:20.000000Z"}, {"uuid": "693b36dc-1a36-45f8-9766-32751ba77a30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10221", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:45.000000Z"}, {"uuid": "9dc3fb7b-9321-469e-adf6-91dd586a05ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10220", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/rconfig_ajaxarchivefiles_rce.rb", "content": "", "creation_timestamp": "2020-03-16T11:28:40.000000Z"}, {"uuid": "ac3ec3a4-2d5d-4d3c-8b9a-62abe4e1d6c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2020-10221", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/6a4ef356-5bf0-4f09-883a-0bbae45d159a", "content": "", "creation_timestamp": "2026-02-02T12:29:01.132947Z"}, {"uuid": "e9d115c8-a244-4998-9fd9-0935c5d403ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10220", "type": "published-proof-of-concept", "source": "Telegram/C5Uti98yNMibrytNOYJF3eWZ7TSU5JhC3eF6W16W_xddRY4", "content": "", "creation_timestamp": "2025-07-30T15:00:07.000000Z"}, {"uuid": "1201a805-ed50-49ae-9c7d-ecf4e4d5b7f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10221", "type": "seen", "source": "Telegram/KmxkWteBXNjKTx4bW6Rm7_lXyJ92aqzkplW5FcHhaaY26giq", "content": "", "creation_timestamp": "2025-02-06T02:42:30.000000Z"}, {"uuid": "ece6e417-a8dd-463a-ad2d-afe103dfd537", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10220", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/810", "content": "#exploit\nCVE-2020-10220:\nRconfig 3.x - Chained RCE\nhttps://packetstormsecurity.com/files/156766\nrConfig 3.9 - 'searchColumn' SQL Injection\nhttps://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_CVE-2020-10220.py", "creation_timestamp": "2024-10-10T02:58:41.000000Z"}, {"uuid": "fb0a12f2-9ac6-4059-8633-89407884b547", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10221", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d04c1375-bee8-4b18-8c53-bab5ecc90d2f", "content": "", "creation_timestamp": "2026-06-19T12:48:03.215299Z"}, {"uuid": "6a45d763-6285-40ec-8cd8-9ad29692a30c", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10221", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/5949dc1d-9176-41ff-85d7-7e47f2cbbb99", "content": "", "creation_timestamp": "2026-06-23T14:04:30.979514Z"}, {"uuid": "cd7ca5f6-083d-4c1b-bd50-0a408656d913", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10220", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/rconfig_ajaxarchivefiles_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Jean-Pascal Thomas\", \"Orange Cyberdefense\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits multiple vulnerabilities in rConfig version 3.9\\n          in order to execute arbitrary commands.\\n          This module takes advantage of a command injection vulnerability in the\\n          `path` parameter of the ajax archive file functionality within the rConfig web\\n          interface in order to execute the payload.\\n          Valid credentials for a user with administrative privileges are required.\\n          However, this module can bypass authentication via SQLI.\\n          This module has been successfully tested on Rconfig 3.9.3 and 3.9.4.\\n          The steps are:\\n          1. SQLi on /commands.inc.php allows us to add an administrative user.\\n          2. An authenticated session is established with the newly added user\\n          3. Command Injection on /lib/ajaxHandlers/ajaxArchiveFiles.php allows us to\\n          execute the payload.\\n          4. Remove the added admin user.\\n          Tips : once you get a shell, look at the CVE-2019-19585.\\n          You will probably get root because rConfig install script add Apache user to\\n          sudoers with nopasswd ;-)\", \"disclosure_date\": \"2020-03-11\", \"fullname\": \"exploit/linux/http/rconfig_ajaxarchivefiles_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 13:20:20 +0000\", \"name\": \"Rconfig 3.x Chained Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"config-changes\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/rconfig_ajaxarchivefiles_rce.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 400, \"ref_name\": \"linux/http/rconfig_ajaxarchivefiles_rce\", \"references\": [\"CVE-2019-19509\", \"CVE-2020-10220\", \"EDB-47982\", \"EDB-48208\", \"URL-https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_CVE-2019-19509.py\", \"URL-https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_CVE-2020-10220.py\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Auto\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:54.198760Z"}]}