CVE-2007-4533

Vavoom < 1.24 - Remote Code Execution via Say Command Format String

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-4533. PoCs published by Luigi Auriemma.

AI-analyzed exploit summary The provided text describes multiple vulnerabilities in Vavoom 1.24, including buffer overflow, format string, and DoS issues. It mentions an attack vector for the format-string vulnerability via a chat message containing '%n%n%n%n%s'.

Description

Format string vulnerability in the Say command in sv_main.cpp in Vavoom 1.24 and earlier allows remote attackers to execute arbitrary code via format string specifiers in a chat message, related to a call to the BroadcastPrintf function.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Luigi Auriemma · textdosmultiple

https://www.exploit-db.com/exploits/30526

View Code ZIP pw:eip

The provided text describes multiple vulnerabilities in Vavoom 1.24, including buffer overflow, format string, and DoS issues. It mentions an attack vector for the format-string vulnerability via a chat message containing '%n%n%n%n%s'.

Classification

Writeup 90%

Attack Type

Rce | Dos

Complexity

Trivial

Reliability

Theoretical

Target: Vavoom 1.24

No auth needed

Prerequisites: Network access to the target application · Ability to send chat messages to the target

MITRE ATT&CK