CVE-2007-6378

BadBlue < 2.72b - Unauthenticated Path Traversal and Arbitrary File Write via Filename Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-6378.

AI-analyzed exploit summary The exploit demonstrates a buffer overflow in BadBlue's PassThru command via a crafted HTTP request, along with directory traversal and path disclosure vulnerabilities. It includes functional PoC code for remote exploitation.

Description

Directory traversal vulnerability in upload.dll in BadBlue 2.72b and earlier allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the filename parameter.

Exploits (1)

exploitdb WORKING POC

remotewindows

https://www.exploit-db.com/exploits/4715

View Code ZIP pw:eip

The exploit demonstrates a buffer overflow in BadBlue's PassThru command via a crafted HTTP request, along with directory traversal and path disclosure vulnerabilities. It includes functional PoC code for remote exploitation.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: BadBlue <= 2.72b

No auth needed

Prerequisites: network access to the target server

MITRE ATT&CK