CVE-2020-23148 | BDVDB-2026-158365 Detail

Description#

The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via a crafted POST request.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/rconfig/rconfig/blob/7ef8bd8d606bc10835e1b8f6f72a2048094816d3/www/ldap/authenticate.php#L34
https://cwe.mitre.org/data/definitions/90.html

Exploit#

No public exploit known

History#

Version 12021-08-09Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.