Webmin 1.580 - '/file/show.cgi' Remote Command Execution (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Webmin /file/show.cgi Remote Command...

Webmin /file/show.cgi Remote Command Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Webmin /file/show.cgi Remote Command...

Webmin /file/show.cgi Remote Command Execution

Exploit for linux platform in category remote exploits This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core'...

CVE-2012-4893

Multiple cross-site request forgery CSRF vulnerabilities in file/show.cgi in Webmin 1.590 and earlier allow remote attackers to hijack the authentication of privileged users for requests that 1 read files or execute 2 tar, 3 zip, or 4 gzip commands, a different issue than CVE-2012-2982...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in file/show.cgi in Webmin 1.590 and earlier allow remote attackers to hijack the authentication of privileged users for requests that 1 read files or execute 2 tar, 3 zip, or 4 gzip commands, a different issue than CVE-2012-2982...

CVE-2012-4893

Multiple cross-site request forgery CSRF vulnerabilities in file/show.cgi in Webmin 1.590 and earlier allow remote attackers to hijack the authentication of privileged users for requests that 1 read files or execute 2 tar, 3 zip, or 4 gzip commands, a different issue than CVE-2012-2982...

CVE-2012-4893

Webmin

CVE-2012-2982

file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid character in a pathname, as demonstrated by a | pipe character...

CVE-2012-2981

Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary Perl code via a crafted file associated with the type aka monitor type name parameter...

CVE-2012-2983

file/edithtml.cgi in Webmin 1.590 and earlier does not perform an authorization check before showing a file's unedited contents, which allows remote attackers to read arbitrary files via the file field...

Design/Logic Flaw

Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary Perl code via a crafted file associated with the type aka monitor type name parameter...

Code injection

file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid character in a pathname, as demonstrated by a | pipe character...

Authorization

file/edithtml.cgi in Webmin 1.590 and earlier does not perform an authorization check before showing a file's unedited contents, which allows remote attackers to read arbitrary files via the file field...

CVE-2012-2982

CVE-2012-2982 is a Webmin vulnerability affecting 1.590 and earlier in /file/show.cgi that allows an authenticated user to execute arbitrary commands via an invalid pathname (notably with a pipe). Public details include exploit modules and multiple advisories; remediation is upgrading Webmin to a...

CVE-2012-2982

file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid character in a pathname, as demonstrated by a | pipe character...

CVE-2012-2983

file/edithtml.cgi in Webmin 1.590 and earlier does not perform an authorization check before showing a file's unedited contents, which allows remote attackers to read arbitrary files via the file field...

CVE-2012-2981

Webmin versions 1.590 and earlier are vulnerable to remote authenticated code execution via a crafted file tied to the type (monitor type name) parameter. The CVE entry CVE-2012-2981 lists this as an arbitrary Perl code execution with CVSS v2 base score 6.0 (network, single authentication, partia...

CVE-2012-2981

Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary Perl code via a crafted file associated with the type aka monitor type name parameter...

CVE-2012-2983

Summary (CVE-2012-2983) : Webmin is affected by a directory/file-parameter traversal in the edit_html.cgi component on Webmin 1.590 and earlier. The root cause is the lack of an authorization check before displaying a file’s unedited contents, allowing remote attackers to read arbitrary files via...

Webmin contains input validation vulnerabilities

Overview Webmin 1.580, and possibly earlier versions, has been reported to contain input validation vulnerabilities. Description The advisories from American Information Security Group report the following vulnerabilities.CWE-20: Improper Input Validation - CVE-2012-2981 "An input validation flaw...