XSS in Webmin 1.540 + exploit for privilege escalation

download video(OGV):
http://www.mediafire.com/?33dz14oueou531w

Details
-------------------
Webmin is affected by a XSS vulnerability in all versions prior to and including 1.540.
Webmin fails to sanitize $real in useradmin/index.cgi. $real is the "Full Name" in the finger information of the user. useradmin/index.cgi is the control panel of the "Users & Groups" section in webmin.
An attacker that has a normal user on the victim's machine could be able to change his Full Name with chfn command, inject XSS and execute commands as root.

Credits
-------------------
Javier Bassi- http://javierb.com.ar
Special thanks to barbarianbob from sla.ckers.org for compressing the XSS from 92 chars to 80.

References
-------------------
1. Advisory URL: http://javierb.com.ar/2011/04/23/xss-webmin-1-540/

Category:

Science & Technology

Tags:

• webmin
• xss
• exploit