Description (CNA)
EChat Server 3.1 contains a buffer overflow vulnerability in the chat.ghp endpoint that allows remote attackers to execute arbitrary code by supplying an oversized username parameter. Attackers can send a GET request to chat.ghp with a malicious username value containing shellcode and ROP gadgets to achieve code execution in the application context.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Echatserver / EChat Server | affected 3.1 |
CWE
CWE-787
References
- https://www.exploit-db.com/exploits/44155
- https://www.vulncheck.com/advisories/echat-server-buffer-overflow-via-chat-ghp-username-parameter
ADP enrichment
No English description supplied.
No references supplied.