Exploit Mbedthis AppWeb 2.2.2 - URL Protocol Format String

[Exploiter]

EDB-ID

30187

Проверка EDB

1. Пройдено

Автор

NIR RACHMEL

Тип уязвимости

DOS

Платформа

MULTIPLE

CVE

cve-2007-3009

Дата публикации

2007-06-12

source: https://www.securityfocus.com/bid/24454/info

Mbedthis AppWeb is prone to a format-string vulnerability because the application fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

This issue affects only applications that were built with logging enabled and installed with no "ErrorLog" directive in 'appweb.conf'.

Successful exploits may allow remote attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will likely crash the application, denying further service to legitimate users.

AppWeb 2.2.2 is reported vulnerable; other versions may also be affected.

'GET %n://localhost:80/" request'