CVE-2007-0338

Dream FTP Server - Remote Code Execution via USER Command Format String Overflow

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-0338. PoCs published by Marsu.

AI-analyzed exploit summary This exploit targets a format string vulnerability in BolinTech DreamFTP server by sending a malformed USER command with format specifiers to overwrite EDX and potentially achieve code execution. The PoC demonstrates a denial-of-service (DoS) by crashing the server.

Description

Heap-based buffer overflow in Dream FTP Server allows remote attackers to execute arbitrary code via a USER command with a large number of format string specifiers, which triggers the overflow during processing of the Server Log.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Marsu · cdoswindows

https://www.exploit-db.com/exploits/3128

View Code ZIP pw:eip

This exploit targets a format string vulnerability in BolinTech DreamFTP server by sending a malformed USER command with format specifiers to overwrite EDX and potentially achieve code execution. The PoC demonstrates a denial-of-service (DoS) by crashing the server.

Classification

Working Poc 90%

Attack Type

Dos

Complexity

Trivial

Reliability

Reliable

Target: BolinTech DreamFTP

No auth needed

Prerequisites: Network access to the DreamFTP server

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3

Core References

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/23731

Exploit, Third Party Advisory exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/3128

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://osvdb.org/32816

Scores

EPSS 0.0471

EPSS Percentile 90.6%

Details

Status published

Products (1)

bolintech/dreamftp_server

Published Jan 18, 2007

Tracked Since Feb 18, 2026