Command injection

An issue was discovered in Webmin =1.920. The parameter old in passwordchange.cgi contains a command injection vulnerability...