Webmin is a web-based interface for system administration of Unix systems. The Webmin web server listens by default on port 10000/tcp.
Webmin 1.59 and earlier are vulnerable to remote code execution as a result of improper sanitization of path information passed to
**show.cgi** which is later used in an open() function call. An authenticated user could exploit this vulnerability to inject and execute arbitrary shell commands.
Upgrade to Webmin 1.60 or later.
This exploit has been tested against Webmin 1.580 on CentOS 6 with Exec-Shield enabled.
A valid Webmin user's credentials must be given to the exploit script.
**nc**) utility must be installed on the target platform.
This vulnerability is found only in specific, non-default configurations.