CVE-2021-31762
HIGHWebmin 1.973 - Cross-Site Request Forgery via User Addition Feature
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2021-31762. PoCs published by Mesh3l_911, electronicbots, Mesh3l911.
AI-analyzed exploit summary This exploit demonstrates a CSRF vulnerability in Webmin 1.973 and earlier versions, allowing an attacker to create a malicious HTML form that, when visited by an authenticated user, can modify user settings or create new users without their consent.
Description
Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to create a privileged user through Webmin's add users feature, and then get a reverse shell through Webmin's running process feature.
Exploits (3)
This exploit demonstrates a CSRF vulnerability in Webmin 1.973 and earlier versions, allowing an attacker to create a malicious HTML form that, when visited by an authenticated user, can modify user settings or create new users without their consent.
This repository contains a functional exploit for CVE-2021-31762, which leverages a CSRF vulnerability in Webmin to create a privileged user and achieve remote command execution. The exploit generates an HTML file that, when visited by an authenticated user, submits a crafted POST request to add a new user with elevated privileges.
This repository contains a functional exploit for CVE-2021-31762, which leverages a CSRF vulnerability in Webmin to create a privileged user and subsequently achieve remote command execution. The exploit generates an HTML file that, when accessed by an authenticated Webmin user, submits a crafted POST request to create a new admin user.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H