CVE-2015-2079

The vulnerable uconfig_save.cgi script handles the sig_file_free parameter using the two-argument form of the Perl open() function instead of the safer three-argument version. In the two-argument form, Perl interprets special characters (e.g., pipe '|') in the filename as shell commands to be executed. An attacker can pass a crafted parameter value containing arbitrary system commands, which will be executed with the privileges of the Usermin server process.

An authenticated attacker can execute arbitrary code on the server (RCE), which can lead to complete system takeover, data theft, and violation of confidentiality, integrity, and availability of resources.

Usermin should be updated to version 1.660 or later. If an update is not immediately possible, consider restricting access to the Usermin interface at the network level (firewall) to trusted IP addresses.

Usermin in versions from 0.980 to 1.x before 1.660