XM Easy Personal FTP Server - 'APPE' / 'DELE' Denial of Service

ExploitDBExploitDB exploitExploitEDB-10104

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The Python script implements a denial-of-service exploit against XM Easy Personal FTP Server 5.8.0 by sending an APPE command on one connection and a DELE command on a second connection, as described in CVE-2009-4048.

Backdoor review

No backdoor observed in reviewed code

The Python script is a straightforward proof-of-concept for CVE-2009-4048. It opens two FTP control connections, issues an APPE command on the first, closes it, then issues a DELE command on the second to trigger a denial of service. No backdoor, trojan, or deceptive behavior is present.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesPython
Target softwareXM Easy Personal FTP Server
Attack typesDenial of Service
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends crafted FTP commands (APPE and DELE) to trigger a denial-of-service condition, which is the definition of an exploit.

exploits/windows/dos/10104.py:42exploits/windows/dos/10104.py:66

Requirements

  • Valid FTP credentials (username and password) for the target server.exploits/windows/dos/10104.py:6-7
  • Network connectivity to the target FTP server on port 21.exploits/windows/dos/10104.py:19

Observed behavior

  • Authenticates to the FTP server using supplied credentials.exploits/windows/dos/10104.py:25-32
  • Sends an APPE command with a single character argument on the first connection.exploits/windows/dos/10104.py:42
  • Closes the first connection and opens a second authenticated connection.exploits/windows/dos/10104.py:47-64
  • Sends a DELE command with the same single character argument on the second connection.exploits/windows/dos/10104.py:66
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
Connects to target IP on port 21 (FTP control)Standard for an FTP exploit PoCexploits/windows/dos/10104.py:19
Network Connection
Binds a local data socket on 127.0.0.1:31339Used for active FTP data transfer, consistent with the PORT commandexploits/windows/dos/10104.py:34
Ftp Command
Sends APPE and DELE commands with a single-character argumentImplements the described denial-of-service triggerexploits/windows/dos/10104.py:42exploits/windows/dos/10104.py:66
Review boundaries

What the analysis did not establish

  • Only the exploit script was analyzed; no external dependencies or target server were inspected.
  • The script's effectiveness or reliability was not tested.
  • Only the supplied text file was reviewed; no binary files or external resources were inspected.
  • The script's effect on a live target was not verified.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

2