vendor:
Usermin
by:
AkkuS <Özkan Mustafa Akkus>
9
CVSS
CRITICAL
Arbitrary Command Execution
CWE
Product Name: Usermin
Affected Version From: 1.75
Affected Version To: 1.75
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested: Debian 4.9.18
Usermin 1.750 – Remote Command Execution
This module exploits an arbitrary command execution vulnerability in Usermin 1.750 and lower versions. Any user authorized to the "Java file manager" and "Upload and Download" fields can execute arbitrary commands with root privileges. The vulnerability is dangerous as Usermin is the most shared interface with users. The module has been tested successfully with Usermin 1.750 over Debian 4.9.18.
Mitigation:
Update to a version higher than 1.750.
