CVE-2003-1200

Alt-N MDaemon 6.5.2-6.8.5 - Stack-Based Buffer Overflow via Long From Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 4 public exploits for CVE-2003-1200. PoCs published by Metasploit, Rosiello Security, Behrang Fouladi, including Metasploit module exploits/windows/http/mdaemon_worldclient_form2raw.

AI-analyzed exploit summary This exploit targets a stack buffer overflow in Alt-N MDaemon SMTP server (versions <= 6.8.5) via the WorldClient form2raw.cgi script. It leverages an excessively long 'From' field to trigger the vulnerability, delivering a payload that executes when the Raw Queue is processed.

Description

Stack-based buffer overflow in FORM2RAW.exe in Alt-N MDaemon 6.5.2 through 6.8.5 allows remote attackers to execute arbitrary code via a long From parameter to Form2Raw.cgi.

Exploits (4)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/16812

This exploit targets a stack buffer overflow in Alt-N MDaemon SMTP server (versions <= 6.8.5) via the WorldClient form2raw.cgi script. It leverages an excessively long 'From' field to trigger the vulnerability, delivering a payload that executes when the Raw Queue is processed.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Racy
Target: Alt-N MDaemon SMTP server <= 6.8.5
No auth needed
Prerequisites: WorldClient HTTP server installed · X-FromCheck enabled · Access to TCP port 3000
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Rosiello Security · cremotewindows
https://www.exploit-db.com/exploits/23502

This exploit targets a buffer overflow vulnerability in MDaemon/WorldClient mail server by sending a crafted HTTP request with an oversized 'From' field. It includes shellcode to bind a shell on port 58821 and is designed for specific Windows XP targets.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: MDaemon/WorldClient mail server
No auth needed
Prerequisites: Network access to the target mail server · Target running a vulnerable version of MDaemon/WorldClient
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Behrang Fouladi · cdoswindows
https://www.exploit-db.com/exploits/23501

This exploit targets a buffer overflow vulnerability in MDaemon/WorldClient mail server by sending a maliciously crafted HTTP request with an oversized 'From' field. The PoC overwrites EIP and attempts to execute arbitrary code, though the shellcode/payload is not included in this snippet.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Theoretical
Target: MDaemon/WorldClient mail server (version not specified)
No auth needed
Prerequisites: Network access to the target server · MDaemon/WorldClient with vulnerable form2raw.cgi endpoint
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC GREAT
by aushack · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/mdaemon_worldclient_form2raw.rb

This Metasploit module exploits a stack buffer overflow in Alt-N MDaemon SMTP server (versions 6.8.5 and earlier) via the WorldClient form2raw.cgi script. The exploit triggers a buffer overflow by sending an excessively long 'From' field, leading to arbitrary code execution when the Raw Queue is processed.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Racy
Target: Alt-N MDaemon SMTP server <= 6.8.5
No auth needed
Prerequisites: WorldClient HTTP server installed · X-FromCheck enabled · Access to TCP port 3000
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/14097
Exploit, Vendor Advisory vdb-entry x_refsource_osvdb
http://www.osvdb.org/3255
Various Sources x_refsource_misc
http://hat-squad.com/bugreport/mdaemon-raw.txt
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/10512
Exploit, Vendor Advisory mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/348454
Exploit, Vendor Advisory vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/9317
Mailing List mailing-list x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=107936753929354&w=2

Scores

EPSS 0.6510
EPSS Percentile 99.2%

Details

Status published
Products (9)
alt-n/mdaemon 6.5.2
alt-n/mdaemon 6.7.5
alt-n/mdaemon 6.7.9
alt-n/mdaemon 6.8.0
alt-n/mdaemon 6.8.1
alt-n/mdaemon 6.8.2
alt-n/mdaemon 6.8.3
alt-n/mdaemon 6.8.4
alt-n/mdaemon 6.8.5
Published Dec 29, 2003
Tracked Since Feb 18, 2026