cve/cves/2019/CVE-2019-12840.md

CVE-2019-12840

Description

In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi.

POC

Reference

• http://packetstormsecurity.com/files/153372/Webmin-1.910-Remote-Command-Execution.html
• https://pentest.com.tr/exploits/Webmin-1910-Package-Updates-Remote-Command-Execution.html
• https://www.exploit-db.com/exploits/46984

Github

• https://github.com/KrE80r/webmin_cve-2019-12840_poc
• https://github.com/Pol-Ruiz/PoC-CVE-2019-12840
• https://github.com/WizzzStark/CVE-2019-12840.py
• https://github.com/bkaraceylan/CVE-2019-12840_POC
• https://github.com/fenix0499/CVE-2019-12840-NodeJs-Exploit
• https://github.com/zAbuQasem/CVE-2019-12840
• https://github.com/note0577/CVE-2019-12840-NodeJs-Exploit
• https://github.com/adr-camacho/RedTeam-Ops-Roadmap

ExploitDB

• https://www.exploit-db.com/exploits/46984

Metasploit

• https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/webmin_packageup_rce.rb