Exploit for OS Command Injection in Webmin

githubexploit · 2021-10-05

Description

Exploit for OS Command Injection in Webmin CVE-2019-1284

Entry point

Parameteru · data

Pathpackage-updates/update.cgi

Arbitrary command execution via the data parameter to Webmin package-updates update.cgi (CVE-2019-12840).

Affected Webmin versions

Webmin≤ 1.910

All known vulnerabilities by product

CVSS 9.0 for CVE-2019-12840

9.0

HIGH SEVERITY

Version 2.0

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:LOW

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Working code

98%confidence this exploit runs

Based on 2 file(s) in the source

EPSS Score

77.8%higher than 99.5% of all CVEs

Updated 2026-07-14

Exploit Details

Modified:2021-10-05 18:12

Last Seen:2025-08-31 20:40

Reporter:WizzzStark

Written in:Python

Last commit:2021-10-05

Tags

os command injectionwebminCVE-2019-12840authenticated rcepackage updates

Other exploits for CVE-2019-12840

Webmin 1.962 Remote Command Execution

2020-12-22 AkkuSPACKETSTORMRuby

Exploit for OS Command Injection in Webmin

2019-11-09 KrE80rGITHUB

Exploit for OS Command Injection in Webmin

2019-11-05 bkaraceylanGITHUB

Webmin Package Updates Remote Command Execution

2019-06-16 AkkuS <Özkan Mustafa Akkuş>METASPLOITRuby

Webmin 1.910 - Package Updates Remote Command Execution (Metasploit)

2019-06-11 AkkuSEXPLOITPACKRuby

Webmin 1.910 - 'Package Updates' Remote Command Execution (Metasploit)

2019-06-11 AkkuSEXPLOITDBRuby

Webmin 1.910 Remote Command Execution

2019-06-11 Ozkan Mustafa AkkusPACKETSTORMRuby

Exploit Code

README5 lines

## https://sploitus.com/exploit?id=BF487E22-D4B8-51DC-BABA-F2057F0CA7FD
# CVE-2019-12840.py
POC (Fake Shell):

CVE-2019-12840 (Authenticated RCE - Webmin Package Updates)