CVE-2019-15107

CVE-2019-15107 test program

This remote command execution vulnerability in webmin, roughly caused by perl's qx/…/ leading to command execution, requires certain special conditions. During reproduction, I casually wrote a graphical exploit program.

It is worth noting that the user value must be a fake user; testing with the real root user does not succeed. Only when the value of the sent user parameter is not a known Linux user will the display proceed to the part where /etc/shadow is modified, thereby triggering the command injection vulnerability.

Reverse shell may require encoding, which might need code modification.