In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution.

Summary

In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution.

Timeline

1. Apr 16, 2020, 5:42 PM UTCCVE published
2. Sep 2, 2020Public exploit on Exploit-DB

   EDB-48784, EDB-49238

3. Aug 4, 2024, 11:42 AM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

References 4