CVE-2020-15713: 
rConfig vulnerability analysis and mitigation

rConfig 3.9.5 contains a SQL injection vulnerability identified as CVE-2020-15713. The vulnerability was discovered and disclosed on July 28, 2020. The issue affects the devices.php script, specifically through the sortBy parameter, which can be exploited by authenticated remote attackers (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-89 (SQL Injection). The issue specifically involves improper neutralization of special elements used in SQL commands in the devices.php script (NVD).

If successfully exploited, this vulnerability allows an authenticated attacker to view, add, modify, or delete information in the back-end database. The high CVSS score reflects the significant potential impact on confidentiality, integrity, and availability of the system (NVD).

The vulnerability requires authentication for exploitation, but has low attack complexity and requires no user interaction. The attack can be performed remotely through network access (NVD).

Users should refer to the rConfig release notes for patch information and upgrade guidance (Release Notes).