CVE-2007-3360

BitchX 1.1-final - Command Injection

Title source: llm

Description

hook.c in BitchX 1.1-final allows remote IRC servers to execute arbitrary commands by sending a client certain data containing NICK and EXEC strings, which exceeds the bounds of a hash table, and injects an EXEC hook function that receives and executes shell commands.

Exploits (1)

exploitdb WORKING POC VERIFIED

by clarity_ · cremotelinux

https://www.exploit-db.com/exploits/4087

View Code ZIP pw:eip

References (7)

[Vendor Advisory] http://secunia.com/advisories/25759

[Vendor Advisory] http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.285737

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/34969

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/24579

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/4087

[Third Party Advisory, VDB Entry] http://osvdb.org/37479

[Third Party Advisory] http://secunia.com/advisories/34870

Scores

EPSS 0.1020

EPSS Percentile 93.2%

Details

Status published

Products (1)

bitchx/bitchx 1.1-final

Published Jun 22, 2007

Tracked Since Feb 18, 2026