An attacker can directly execute system commands by sending a GET request to search.crud.php because the catCommand. parameter is passed to the exec function without filtering, which can lead to command execution. The catCommand.paramparameter is passed without filtering and can be used to execute commands. The issue was discovered in rConfig 3.9.2.2. The vulnerability is described as CVE-2019-16663. The attacker can use the cat command to execute a system command without filtering.”]