CVE-2019-15107— Webmin 命令操作系统命令注入漏洞
已观察到在野利用 cisa_kev · confirmed
获取后续新漏洞提醒登录后订阅
一、 漏洞 CVE-2019-15107 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗ 尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
N/A
来源: 美国国家漏洞数据库 NVD
Vulnerability Description
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.
来源: 美国国家漏洞数据库 NVD
CVSS Information
N/A
来源: 美国国家漏洞数据库 NVD
Vulnerability Type
N/A
来源: 美国国家漏洞数据库 NVD
Vulnerability Title
Webmin 命令操作系统命令注入漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Webmin是一套基于Web的用于类Unix操作系统中的系统管理工具。 Webmin 1.920及之前版本中的password_change.cgi存在命令操作系统命令注入漏洞。该漏洞源于外部输入数据构造可执行命令过程中，网络系统或产品未正确过滤其中的特殊元素。攻击者可利用该漏洞执行非法命令。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| - | n/a | n/a | - |
二、漏洞 CVE-2019-15107 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | CVE-2019-15107 Webmin RCE (unauthorized) | https://github.com/jas502n/CVE-2019-15107 | POC详情 |
| 2 | Dockerfiles for CVE-2019-15107(webmin RCE) recurrence including v1.890 and v1.920 with Exp for each version. | https://github.com/HACHp1/webmin_docker_and_exp | POC详情 |
| 3 | Implementation of CVE-2019-15107 exploit in python | https://github.com/ketlerd/CVE-2019-15107 | POC详情 |
| 4 | CVE-2019-15107 webmin python3 | https://github.com/AdministratorGithub/CVE-2019-15107 | POC详情 |
| 5 | Built a custom Virtual Machine, running Ubuntu 18.04.1 and Webmin 1.810. Using CVE-2019-15107 to exploit a backdoor in the Linux machine | https://github.com/Rayferrufino/Make-and-Break | POC详情 |
| 6 | Remote Code Execution Vulnerability in Webmin | https://github.com/AleWong/WebminRCE-EXP-CVE-2019-15107- | POC详情 |
| 7 | None | https://github.com/ianxtianxt/CVE-2019-15107 | POC详情 |
| 8 | poc exploit for webmin backdoor (CVE-2019-15107 and CVE-2019-15231) | https://github.com/hannob/webminex | POC详情 |
| 9 | webmin_CVE-2019-15107 | https://github.com/ChakoMoonFish/webmin_CVE-2019-15107 | POC详情 |
| 10 | None | https://github.com/cdedmondson/Modified-CVE-2019-15107 | POC详情 |
| 11 | Webmin <=1.920 RCE | https://github.com/ruthvikvegunta/CVE-2019-15107 | POC详情 |
| 12 | CVE-2019-15107 exploit | https://github.com/n0obit4/Webmin_1.890-POC | POC详情 |
| 13 | CVE-2019–15107 - Unauthenticated RCE Webmin <=1.920 | https://github.com/squid22/Webmin_CVE-2019-15107 | POC详情 |
| 14 | None | https://github.com/MuirlandOracle/CVE-2019-15107 | POC详情 |
| 15 | None | https://github.com/diegojuan/CVE-2019-15107 | POC详情 |
| 16 | CVE-2019-15107 Webmin Exploit in C | https://github.com/whokilleddb/CVE-2019-15107 | POC详情 |
| 17 | None | https://github.com/puckiestyle/CVE-2019-15107 | POC详情 |
| 18 | Something I wrote for CVE-2019-15107, a Webmin backdoor | https://github.com/darrenmartyn/CVE-2019-15107 | POC详情 |
| 19 | Exploit para CVE-2019-15107 (Webmin 1.890-1.920) sin credenciales RCE escrito en PYTHON. | https://github.com/hacknotes/CVE-2019-15107-Exploit | POC详情 |
| 20 | None | https://github.com/Tuz-Wwsd/CVE-2019-15107_detection | POC详情 |
| 21 | CVE-2019-15107 Webmin 1.920 RCE | https://github.com/hadrian3689/webmin_1.920 | POC详情 |
| 22 | CVE-2019-15107 | https://github.com/f0rkr/CVE-2019-15107 | POC详情 |
| 23 | unauthorized RcE exploit for webnin < 1.920 | https://github.com/psw01/CVE-2019-15107_webminRCE | POC详情 |
| 24 | Python3 code to exploit CVE-2019-15107 and CVE-2019-15231 | https://github.com/lolminerxmrig/CVE-2019-15107 | POC详情 |
| 25 | WebMin Versions <= 1.920 [CVE-2019-15107] RCE PoC | https://github.com/TheAlpha19/MiniExploit | POC详情 |
| 26 | CVE-2019-15107 图形化测试程序 | https://github.com/wenruoya/CVE-2019-15107 | POC详情 |
| 27 | webmin <=1.920 - RCE via command injection vulnerability | https://github.com/g1vi/CVE-2019-15107 | POC详情 |
| 28 | A PoC exploit for CVE-2019-1510 - Webmin Command Injection. | https://github.com/K3ysTr0K3R/CVE-2019-15107-EXPLOIT | POC详情 |
| 29 | school project | https://github.com/gozn/detect-CVE-2019-15107-by-pyshark | POC详情 |
| 30 | None | https://github.com/h4ck0rman/CVE-2019-15107 | POC详情 |
| 31 | None | https://github.com/olingo99/CVE-2019-15107 | POC详情 |
| 32 | Exploit for Webmin servers versions 1.890 through 1.920. | https://github.com/aamfrk/Webmin-CVE-2019-15107 | POC详情 |
| 33 | RCE for Webmin CVE-2019-15107 | https://github.com/0x4r2/Webmin-CVE-2019-15107 | POC详情 |
| 34 | CVE-2019-15107 Webmin unauthenticated RCE | https://github.com/NasrallahBaadi/CVE-2019-15107 | POC详情 |
| 35 | CVE-2019-15107 webmin 취약점에 대해서 직접 서버를 구축하고 공격 결과를 남긴 정보입니다. | https://github.com/grayorwhite/CVE-2019-15107 | POC详情 |
| 36 | None | https://github.com/CyberTuz/CVE-2019-15107_detection | POC详情 |
| 37 | webmin or minisever RCE | https://github.com/MasterCode112/CVE-2019-15107 | POC详情 |
| 38 | Webmin-RCE-PoC-CVE-2019-15107 is a Python-based scanner that detects vulnerable Webmin (1.890 - 1.920) servers affected by CVE-2019-15107, an unauthenticated remote code execution (RCE) vulnerability in the /password_change.cgi endpoint. | https://github.com/Mattb709/CVE-2019-15107-Scanner | POC详情 |
| 39 | A Python proof-of-concept exploit for CVE-2019-15107 - an unauthenticated remote code execution vulnerability in Webmin versions 1.890 through 1.920. | https://github.com/Mattb709/CVE-2019-15107-Webmin-RCE-PoC | POC详情 |
| 40 | Webmin <=1.920. is vulnerable to an unauthenticated remote command execution via the parameter 'old' in password_change.cgi. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15107.yaml | POC详情 |
| 41 | None | https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/Webmin%20password_change.cgi%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CVE-2019-15107.md | POC详情 |
| 42 | None | https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/Webmin%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CVE-2019-15107.md | POC详情 |
| 43 | Webmin 远程命令执行漏洞（CVE-2019-15107） | https://github.com/chaitin/xray-plugins/blob/main/poc/manual/webmin-cve-2019-15107-rce.yml | POC详情 |
| 44 | https://github.com/vulhub/vulhub/blob/master/webmin/CVE-2019-15107/README.md | POC详情 | |
| 45 | webmin_CVE-2019-15107 | https://github.com/ch4ko/webmin_CVE-2019-15107 | POC详情 |
| 46 | None | https://github.com/m4lk3rnel/CVE-2019-15107 | POC详情 |
| 47 | None | https://github.com/EdouardosStav/CVE-2019-15107-RCE-WebMin | POC详情 |
| 48 | exploit for CVE-2019-15107 | https://github.com/bayazid-bit/CVE-2019-15107 | POC详情 |
| 49 | Research Objective: To conduct a comprehensive analysis and successful exploitation of a Remote Code Execution (RCE) vulnerability in Webmin version 1.890 (CVE-2019-15107), ultimately gaining full control over the target system. | https://github.com/ArtemCyberLab/Project-Exploitation-of-Webmin-Authentication-Vulnerability | POC详情 |
AI 生成 POC高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2019-15107 的情报信息
请登录查看更多情报信息。
CVE-2019-15107 公开利用代码 (5)
CVE-2019-15107 其他参考 (3)
- http://www.webmin.com/security.htmlx_refsource_MISC
同批安全公告 · n/a · 2019-08-16 · 共 40 条
| CVE-2017-18544 | WordPress invite-anyone插件跨站请求伪造漏洞 | |
| CVE-2014-10376 | WordPress i-recommend-this插件SQL注入漏洞 | |
| CVE-2015-9324 | WordPress easy-digital-downloads插件SQL注入漏洞 | |
| CVE-2019-15116 | WordPress easy-digital-downloads插件跨站脚本漏洞 | |
| CVE-2015-9323 | WordPress 404-to-301插件SQL注入漏洞 | |
| CVE-2019-15115 | WordPress peters-login-redirect插件跨站请求伪造漏洞 | |
| CVE-2017-18547 | WordPress nelio-ab-testing插件跨站请求伪造漏洞 | |
| CVE-2018-20974 | WordPress js-jobs插件跨站请求伪造漏洞 | |
| CVE-2017-18546 | WordPress jayj-quicktag插件跨站请求伪造漏洞 | |
| CVE-2017-18545 | WordPress invite-anyone插件输入验证错误漏洞 | |
| CVE-2019-15120 | Kunena extension for Joomla! 跨站脚本漏洞 | |
| CVE-2017-18543 | WordPress invite-anyone插件访问控制错误漏洞 | |
| CVE-2019-15114 | WordPress formcraft-form-builder插件跨站请求伪造漏洞 | |
| CVE-2015-9322 | WordPress erident-custom-login-and-dashboard插件跨站请求伪造漏洞 | |
| CVE-2019-15113 | WordPress companion-sitemap-generator插件跨站请求伪造漏洞 | |
| CVE-2018-20973 | WordPress companion-auto-update插件输入验证错误漏洞 | |
| CVE-2018-20972 | WordPress companion-auto-update插件跨站请求伪造漏洞 | |
| CVE-2018-20971 | WordPress church-admin插件跨站请求伪造漏洞 | |
| CVE-2017-18542 | WordPress zendesk-help-center插件跨站脚本漏洞 | |
| CVE-2017-18541 | WordPress xo-security插件跨站脚本漏洞 |
显示前 20 条，共 40 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2019-15107
暂无评论