cve/2011/CVE-2011-1937.md

CVE-2011-1937

Description

Cross-site scripting (XSS) vulnerability in Webmin 1.540 and earlier allows local users to inject arbitrary web script or HTML via a chfn command that changes the real (aka Full Name) field, related to useradmin/index.cgi and useradmin/user-lib.pl.

POC

Reference

• http://securityreason.com/securityalert/8264
• http://www.youtube.com/watch?v=CUO7JLIGUf0
• 46e3d3ad19

Github

No PoCs found on GitHub currently.