CVE-2007-4915
Boa Webserver 0.93.15 - Remote Admin Password Change via Long Username in HTTP Basic Authentication
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2007-4915.
PoCs published by ikki, Luca Carettoni, Luca, including Metasploit module auxiliary/admin/http/intersil_pass_reset.
AI-analyzed exploit summary This exploit bypasses HTTP Basic Authentication in Boa/0.93.15 by sending an excessively long username, allowing an attacker to set a new password without proper authentication. The PoC uses Python's urllib2 to send a crafted request.
Description
The Intersil isl3893 extensions for Boa 0.93.15, as used on the FreeLan RO80211G-AP and other devices, do not prevent stack writes from entering memory locations used for string constants, which allows remote attackers to change the admin password stored in memory via a long username in an HTTP Basic Authentication request.
Exploits (3)
This exploit bypasses HTTP Basic Authentication in Boa/0.93.15 by sending an excessively long username, allowing an attacker to set a new password without proper authentication. The PoC uses Python's urllib2 to send a crafted request.
This exploit leverages an authentication bypass vulnerability in Boa web server by overwriting the password via a crafted HTTP request. It uses a long username to trigger the vulnerability and sets a new password to gain unauthorized access.
This Metasploit module exploits a buffer overflow in Boa HTTP Server (0.93.x - 0.94.11) to bypass basic authentication by sending a long username (127+ bytes) that overwrites the password in memory, allowing password reset or DoS.