EChat Server 3.1 Buffer Overflow via chat.ghp username Parameter
Vulnerability Description
EChat Server 3.1 contains a buffer overflow vulnerability in the chat.ghp endpoint that allows remote attackers to execute arbitrary code by supplying an oversized username parameter. Attackers can send a GET request to chat.ghp with a malicious username value containing shellcode and ROP gadgets to achieve code execution in the application context.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-25221
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Juan Sacco <jsacco@exploitpack.com>
References
Affected Vendor
Echatserver
View all reports →