CVE-2019-12840 PoC — Webmin 操作系统命令注入漏洞

Source

https://github.com/zAbuQasem/CVE-2019-12840

Associated Vulnerability

Title:Webmin 操作系统命令注入漏洞 (CVE-2019-12840)
Description:In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi.

Description

CVE-2019-12840

Readme

# CVE-2019-12840
Authenticated RCE in Webmin 1.910 - 'Package Updates'

Usage : 

1-setup a netcat listener.

2- python3 exploit.py 

Notes:

Provide the url for example: http://<ip>:port

Please copy 'sid' cookie from your browser and supply it for the exploit to work...

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!