# N/A
## 漏洞概述
Webmin <=1.920 版本中的 password_change.cgi 脚本存在一个命令注入漏洞，具体影响到参数 old。
## 影响版本
- Webmin <=1.920
## 漏洞细节
在 password_change.cgi 脚本中，参数 old 处理不当，导致存在命令注入漏洞。攻击者可以通过构造特定的输入，注入并执行任意命令。
## 影响
此漏洞可能导致远程代码执行，攻击者可以利用该漏洞执行任意系统命令，进而控制服务器。
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | CVE-2019-15107 Webmin RCE (unauthorized) | https://github.com/jas502n/CVE-2019-15107 | POC详情 |
| 2 | Dockerfiles for CVE-2019-15107(webmin RCE) recurrence including v1.890 and v1.920 with Exp for each version. | https://github.com/HACHp1/webmin_docker_and_exp | POC详情 |
| 3 | Implementation of CVE-2019-15107 exploit in python | https://github.com/ketlerd/CVE-2019-15107 | POC详情 |
| 4 | CVE-2019-15107 webmin python3 | https://github.com/AdministratorGithub/CVE-2019-15107 | POC详情 |
| 5 | Built a custom Virtual Machine, running Ubuntu 18.04.1 and Webmin 1.810. Using CVE-2019-15107 to exploit a backdoor in the Linux machine | https://github.com/Rayferrufino/Make-and-Break | POC详情 |
| 6 | Remote Code Execution Vulnerability in Webmin | https://github.com/AleWong/WebminRCE-EXP-CVE-2019-15107- | POC详情 |
| 7 | None | https://github.com/ianxtianxt/CVE-2019-15107 | POC详情 |
| 8 | poc exploit for webmin backdoor (CVE-2019-15107 and CVE-2019-15231) | https://github.com/hannob/webminex | POC详情 |
| 9 | webmin_CVE-2019-15107 | https://github.com/ChakoMoonFish/webmin_CVE-2019-15107 | POC详情 |
| 10 | None | https://github.com/cdedmondson/Modified-CVE-2019-15107 | POC详情 |
| 11 | Webmin <=1.920 RCE | https://github.com/ruthvikvegunta/CVE-2019-15107 | POC详情 |
| 12 | CVE-2019-15107 exploit | https://github.com/n0obit4/Webmin_1.890-POC | POC详情 |
| 13 | CVE-2019–15107 - Unauthenticated RCE Webmin <=1.920 | https://github.com/squid22/Webmin_CVE-2019-15107 | POC详情 |
| 14 | None | https://github.com/MuirlandOracle/CVE-2019-15107 | POC详情 |
| 15 | None | https://github.com/diegojuan/CVE-2019-15107 | POC详情 |
| 16 | CVE-2019-15107 Webmin Exploit in C | https://github.com/whokilleddb/CVE-2019-15107 | POC详情 |
| 17 | None | https://github.com/puckiestyle/CVE-2019-15107 | POC详情 |
| 18 | Something I wrote for CVE-2019-15107, a Webmin backdoor | https://github.com/darrenmartyn/CVE-2019-15107 | POC详情 |
| 19 | Exploit para CVE-2019-15107 (Webmin 1.890-1.920) sin credenciales RCE escrito en PYTHON. | https://github.com/hacknotes/CVE-2019-15107-Exploit | POC详情 |
| 20 | None | https://github.com/Tuz-Wwsd/CVE-2019-15107_detection | POC详情 |
| 21 | CVE-2019-15107 Webmin 1.920 RCE | https://github.com/hadrian3689/webmin_1.920 | POC详情 |
| 22 | CVE-2019-15107 | https://github.com/f0rkr/CVE-2019-15107 | POC详情 |
| 23 | unauthorized RcE exploit for webnin < 1.920 | https://github.com/psw01/CVE-2019-15107_webminRCE | POC详情 |
| 24 | Python3 code to exploit CVE-2019-15107 and CVE-2019-15231 | https://github.com/lolminerxmrig/CVE-2019-15107 | POC详情 |
| 25 | WebMin Versions <= 1.920 [CVE-2019-15107] RCE PoC | https://github.com/TheAlpha19/MiniExploit | POC详情 |
| 26 | CVE-2019-15107 图形化测试程序 | https://github.com/wenruoya/CVE-2019-15107 | POC详情 |
| 27 | webmin <=1.920 - RCE via command injection vulnerability | https://github.com/g1vi/CVE-2019-15107 | POC详情 |
| 28 | A PoC exploit for CVE-2019-1510 - Webmin Command Injection. | https://github.com/K3ysTr0K3R/CVE-2019-15107-EXPLOIT | POC详情 |
| 29 | school project | https://github.com/gozn/detect-CVE-2019-15107-by-pyshark | POC详情 |
| 30 | None | https://github.com/h4ck0rman/CVE-2019-15107 | POC详情 |
| 31 | None | https://github.com/olingo99/CVE-2019-15107 | POC详情 |
| 32 | Exploit for Webmin servers versions 1.890 through 1.920. | https://github.com/aamfrk/Webmin-CVE-2019-15107 | POC详情 |
| 33 | RCE for Webmin CVE-2019-15107 | https://github.com/0x4r2/Webmin-CVE-2019-15107 | POC详情 |
| 34 | CVE-2019-15107 Webmin unauthenticated RCE | https://github.com/NasrallahBaadi/CVE-2019-15107 | POC详情 |
| 35 | CVE-2019-15107 webmin 취약점에 대해서 직접 서버를 구축하고 공격 결과를 남긴 정보입니다. | https://github.com/grayorwhite/CVE-2019-15107 | POC详情 |
| 36 | None | https://github.com/CyberTuz/CVE-2019-15107_detection | POC详情 |
| 37 | webmin or minisever RCE | https://github.com/MasterCode112/CVE-2019-15107 | POC详情 |
| 38 | Webmin-RCE-PoC-CVE-2019-15107 is a Python-based scanner that detects vulnerable Webmin (1.890 - 1.920) servers affected by CVE-2019-15107, an unauthenticated remote code execution (RCE) vulnerability in the /password_change.cgi endpoint. | https://github.com/Mattb709/CVE-2019-15107-Scanner | POC详情 |
| 39 | A Python proof-of-concept exploit for CVE-2019-15107 - an unauthenticated remote code execution vulnerability in Webmin versions 1.890 through 1.920. | https://github.com/Mattb709/CVE-2019-15107-Webmin-RCE-PoC | POC详情 |
| 40 | Webmin <=1.920. is vulnerable to an unauthenticated remote command execution via the parameter 'old' in password_change.cgi. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15107.yaml | POC详情 |
| 41 | None | https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/Webmin%20password_change.cgi%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CVE-2019-15107.md | POC详情 |
| 42 | None | https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/Webmin%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CVE-2019-15107.md | POC详情 |
| 43 | Webmin 远程命令执行漏洞（CVE-2019-15107） | https://github.com/chaitin/xray-plugins/blob/main/poc/manual/webmin-cve-2019-15107-rce.yml | POC详情 |
| 44 | https://github.com/vulhub/vulhub/blob/master/webmin/CVE-2019-15107/README.md | POC详情 | |
| 45 | webmin_CVE-2019-15107 | https://github.com/ch4ko/webmin_CVE-2019-15107 | POC详情 |
| 46 | None | https://github.com/m4lk3rnel/CVE-2019-15107 | POC详情 |
| 47 | None | https://github.com/EdouardosStav/CVE-2019-15107-RCE-WebMin | POC详情 |
| 48 | exploit for CVE-2019-15107 | https://github.com/bayazid-bit/CVE-2019-15107 | POC详情 |
暂无评论