Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2012-2982-Webmin-RCE — Python PoC for Webmin 1.580 Remote Command Execution (CVE-2012-2982) | Kitploit
Tools/GitHubGitHub/jrrooot/cve-2012-2982-webmin-rce
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & Education
GitHubjrrooot/cve-2012-2982-webmin-rce

CVE-2012-2982-Webmin-RCE

Python PoC for Webmin 1.580 Remote Command Execution (CVE-2012-2982)

View Repository
18 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Webadmin 1.580 RCE PoC (CVE-2012-2982)

This repository contains a Python proof-of-concept (PoC) exploit for Webmin version 1.580, which is vulnerable to Remote Command Execution (RCE) due to improper input sanitization. The vulnerability exists in the file/show.cgi component and allows an authenticated Webmin user with access to the File Manager module to execute arbitrary OS commands as root.

This PoC was developed for educational and research purposes and tested in a controlled lab environment (TryHackMe).

⚠️ This project is intended strictly for educational purposes and authorized security testing only.

🛡️ Vulnerability Details

  • Product: Webmin
  • Version: 1.580
  • CVE: CVE-2012-2982
  • Vulnerability Type: Authenticated Remote Command Execution
  • Impact: Allows authenticated users to execute arbitrary system commands on the server

🛡️ How the Vulnerability Is Exploited

  • The vulnerability exists due to insufficient input validation in the file/show.cgi component of Webmin 1.580
  • User-controlled input is improperly handled by backend shell commands
  • Special characters such as the pipe (|) character are not sanitized
  • An authenticated attacker can inject arbitrary shell commands
  • Injected commands are executed with the privileges of the Webmin process (root)

    • In this PoC:

    • A crafted URL is sent to show.cgi
    • Pipe characters are used to escape intended file-handling logic
    • Arbitrary system commands are executed on the server

    Running the Exploit

    Usage

    root@kitploit:~
    # Usage:
# python3 webmin.py <target> -u <username> -p <password> -c "<command>"

# Example:
python3 webmin.py https://10.10.10.10:10000 -u admin -p admin123 -c "id"

    🛡️ Credits

    • Vulnerability Discovery: CVE-2012-2982 was originally discovered by Weston Wagner of American InfoSec Group
    • This repository provides an independent educational proof-of-concept implementation
    Download Tool