CVE-2012-2982 PoC — Webmin ‘file/show.cgi’任意命令执行漏洞

Source

https://github.com/JohnHammond/CVE-2012-2982

Associated Vulnerability

Title:Webmin ‘file/show.cgi’任意命令执行漏洞 (CVE-2012-2982)
Description:file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid character in a pathname, as demonstrated by a | (pipe) character.

Description

A Python replicated exploit for Webmin 1.580 /file/show.cgi Remote Code Execution

Readme

# CVE-2012-2982

> John Hammond | September 4th, 2021

------------------------


Checking `searchsploit` for Webmin 1.580 I only saw a Metasploit module for
the `/file/show.cgi` Remote Code Execution attack on that legacy Webmin version.

This code is an attempt to recreate that in Python without using Metasploit.



# Files

* `CVE-2021-2982.py` - this offers a one-shot capability to run a single command

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!