What is GHSA-pq7x-3cwv-pj9r?

GHSA-pq7x-3cwv-pj9r is a security advisory published by GitHub Security Advisories with High severity. rConfig 3.9.6 is affected by SQL Injection. A user must be authenticated to exploit the...

Which CVE IDs does GHSA-pq7x-3cwv-pj9r cover?

GHSA-pq7x-3cwv-pj9r covers the following CVE IDs: CVE-2021-29004. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-pq7x-3cwv-pj9r?

GHSA-pq7x-3cwv-pj9r has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-pq7x-3cwv-pj9rHighCVSS 8.8

rConfig 3.9.6 is affected by SQL Injection. A user must be authenticated to exploit the...

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

July 5, 2026

🔗 CVE IDs covered (1)

CVE-2021-29004 →

📋 Description

rConfig 3.9.6 is affected by SQL Injection. A user must be authenticated to exploit the vulnerability. If --secure-file-priv in MySQL server is not set and the Mysql server is the same as rConfig, an attacker may successfully upload a webshell to the server and access it remotely.

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2021-29004
https://github.com/mrojz/rconfig-exploit/blob/main/CVE-2021-29004-POC-req.txt
https://github.com/mrojz/rconfig-exploit/blob/main/README.md
https://rconfig.com
http://rconfig.com
https://github.com/advisories/GHSA-pq7x-3cwv-pj9r