Exploit for OS Command Injection in Webmin

githubexploit · 2019-11-05

Description

OS Command Injection in Webmin CVE-2019-12840_PO

Entry point

Parameteru · data

Pathpackage-updates/update.cgi

Arbitrary command execution via the data parameter to Webmin package-updates update.cgi (CVE-2019-12840).

Affected Webmin versions

Webmin≤ 1.910

All known vulnerabilities by product

CVSS 9.0 for CVE-2019-12840

9.0

HIGH SEVERITY

Version 2.0

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:LOW

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Working code

98%confidence this exploit runs

Based on 2 file(s) in the source

EPSS Score

77.8%higher than 99.5% of all CVEs

Updated 2026-07-14

Exploit Details

Modified:2024-08-12 19:54

Last Seen:2025-08-31 20:35

Reporter:bkaraceylan

Written in:Python

Last commit:2019-11-05

Tags

webmin os command injection remote command execution exploit

Other exploits for CVE-2019-12840

Exploit for OS Command Injection in Webmin

2021-10-05 WizzzStarkGITHUB

Webmin 1.962 Remote Command Execution

2020-12-22 AkkuSPACKETSTORMRuby

Exploit for OS Command Injection in Webmin

2019-11-09 KrE80rGITHUB

Webmin Package Updates Remote Command Execution

2019-06-16 AkkuS <Özkan Mustafa Akkuş>METASPLOITRuby

Webmin 1.910 - Package Updates Remote Command Execution (Metasploit)

2019-06-11 AkkuSEXPLOITPACKRuby

Webmin 1.910 - 'Package Updates' Remote Command Execution (Metasploit)

2019-06-11 AkkuSEXPLOITDBRuby

Webmin 1.910 Remote Command Execution

2019-06-11 Ozkan Mustafa AkkusPACKETSTORMRuby

Exploit Code

README8 lines

## https://sploitus.com/exploit?id=B2FCE9C1-CB15-58B7-90FA-876F72E13FB6
# CVE-2019-12840_POC
PoC for Webmin Package Update Authenticated Remote Command Execution

An alternative to the metasploit module.

All credit goes to Özkan Mustafa Akkuş
https://www.pentest.com.tr/exploits/Webmin-1910-Package-Updates-Remote-Command-Execution.html