CVE-2020-10220: rConfig web interface SQL injection in searchColumn parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable SQL injection with public exploit code and near-maximum EPSS, escalating to remote code execution.

What it is

rConfig through 3.9.4 is vulnerable to SQL injection through the searchColumn parameter in commands.inc.php. The flaw is reachable over the network without authentication, and public exploit code exists, so any exposed rConfig instance is at immediate risk.

Impact

An attacker can read and modify the underlying database, and public chained exploits escalate this to remote code execution on the host.

Attack surface

Reached over the network via the rConfig web interface, specifically the commands.inc.php searchColumn parameter. The CVSS vector shows no privileges and no user interaction required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.99697 (99.95th percentile) and multiple public references include exploit code and chained RCE writeups, indicating active and reliable exploitation.

What to do

• Upgrade rConfig past 3.9.4 to a fixed release; if no fixed version is available, isolate or retire the instance.
• Restrict network access to the rConfig web interface to trusted management networks only.
• Place the application behind a WAF or reverse proxy with SQL injection filtering as a stopgap.
• Run the rConfig service and its database with least-privilege accounts to limit post-exploitation reach.
• Audit the rConfig database and host for unauthorized changes or webshells if exposure is suspected.

Detection

• Monitor web logs for requests to commands.inc.php with unusual or SQL-like searchColumn values.
• Alert on SQL error strings or unexpected database queries originating from the web application.
• Watch for outbound connections or process spawning from the rConfig host consistent with chained RCE.
• Review database and file integrity for unauthorized modifications on rConfig servers.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.