Description
Webmin存在命令注入漏洞，该漏洞是由于对软件包更新模块对输入验证不足造成的。
Webmin Package Updates update.cgi命令注入漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://vuldb.com/vuln/136530
https://www.exploit-db.com/exploits/46984
https://www.sentinelone.com/vulnerability-database/cve-2020-35606/
https://nvd.nist.gov/vuln/detail/cve-2019-12840
https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=31756
https://avd.aliyun.com/detail?id=AVD-2019-12840
https://www.tenablecloud.cn/plugins/nessus/146488
https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/linux/http/webmin_package_updates_rce.rb
https://www.secrss.com/articles/13086
https://juejin.cn/post/7166246223614214151