Improper HTML Escaping in Webmin apt-lib.pl (CVE-2022-36446)

This repository is a small standalone exploit for CVE-2022-36446 affecting Webmin versions earlier than 1.997. It contains two files: a README with usage instructions and one Python exploit script. The script uses `requests` and `BeautifulSoup` to authenticate to Webmin over port 10000, verify login success via `/sysinfo.cgi`, check whether the authenticated user can access the `package-updates` module, and then submit a malicious request to `/package-updates/update.cgi`. The exploit abuses insufficient sanitization of the `u` parameter in the Software Package Updates module to inject a shell command. Its payload is a hardcoded Python3 reverse shell that connects back to an attacker-supplied IP and port and spawns `/bin/sh`. The exploit is authenticated, requires module access, disables TLS certificate verification, and is intended for direct operational use rather than mere detection. The repository is minimal but functional: `README.md` documents prerequisites and execution steps, while `exploit.py` implements the full attack flow from login to exploitation.

This repository contains a single Metasploit module targeting a remote command injection vulnerability (CVE-2022-36446) in Webmin versions prior to 1.997. The exploit abuses insufficient input sanitization in the Software Package Updates module, allowing authenticated users to inject arbitrary commands into package manager operations. The module requires valid credentials for a user with access to the affected module. It supports multiple payloads, including in-memory command execution and Meterpreter reverse shells for x86, x64, and ARM64 Linux systems. The exploit interacts with the Webmin web interface over HTTPS (default port 10000), specifically targeting the /session_login.cgi endpoint for authentication and /package-updates/update.cgi for exploitation. The code is mature, weaponized, and part of the Metasploit framework, making it easy to use and customize for post-exploitation activities.

This repository provides a Python exploit script (CVE-2022-36446.py) targeting CVE-2022-36446, an authenticated remote code execution vulnerability in Webmin versions prior to 1.997. The exploit requires valid Webmin credentials and leverages a command injection flaw in the Software Package Updates module, specifically via the 'u' parameter in POST requests to /package-updates/update.cgi. The script supports both single command execution and an interactive shell mode. The repository also includes a Dockerfile and Makefile under test_env/ to facilitate local testing with a vulnerable Webmin 1.996 instance. The README provides usage instructions, mitigation advice (update to Webmin >= 1.997), and references. The main attack vector is network-based, requiring HTTP(S) access to the target Webmin instance. The exploit is operational, providing real RCE capabilities for authenticated users.