
Unauthenticated RCE via Webmin Backdoor (CVE-2019–15107)
CVE: CVE-2019–15107
Affected Version: Webmin <= 1.920
Attack Vector: Network (HTTPS)
Impact: Unauthenticated Remote Code Execution (Root)
Webmin versions 1.890 through 1.920 contain a backdoor in the password_change.cgi script. The old parameter is passed directly to a shell command without sanitization, allowing unauthenticated command injection. This backdoor was introduced into the Webmin source code distributed via SourceForge. The exploit runs commands as root since Webmin typically runs with root privileges.
python3 webmin-CVE-2019-15107.py <target-host> <target-port>
it will open an shell for you .
(Note: For versions 1.900–1.920, the “expired password changing” feature must be enabled for the backdoor to trigger. Version 1.890 is vulnerable in its default configuration).