CVE-2008-6938

Holger Zimmermann Pi3web < 2.0.3_pl1 - Improper Input Validation

Title source: rule

Description

Pi3Web 2.0.3 before PL2, when installed on Windows as a desktop application and without using the Pi3Web/Conf/Intenet.pi3, allows remote attackers to cause a denial of service (crash or hang) and obtain the full pathname of the server via a request to a file in the ISAPI directory that is not an executable DLL, which triggers the crash when the DLL load fails, as demonstrated using Isapi\users.txt.

Exploits (2)

exploitdb WRITEUP VERIFIED

by Hamid Ebadi · textdoswindows

https://www.exploit-db.com/exploits/7109

View Code ZIP pw:eip

metasploit WORKING POC

rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/windows/http/pi3web_isapi.rb

View Code ZIP pw:eip

References (12)

[Third Party Advisory] http://archives.neohapsis.com/archives/bugtraq/2008-11/0171.html

[Vendor Advisory] http://secunia.com/advisories/32696

[Exploit] http://www.osvdb.org/49998

[Third Party Advisory, VDB Entry] http://www.osvdb.org/49999

[Exploit] http://www.securityfocus.com/archive/1/498865

[Exploit, Patch] http://www.securityfocus.com/bid/32287

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/46600

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/498575

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/498602

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/498770

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/498771

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/7109

Scores

EPSS 0.7369

EPSS Percentile 98.8%

Details

CWE

CWE-20

Status published

Products (5)

holger_zimmermann/pi3web 1.0.1

holger_zimmermann/pi3web 2.0

holger_zimmermann/pi3web 2.0.1

holger_zimmermann/pi3web 2.0.2_beta_1

holger_zimmermann/pi3web < 2.0.3_pl1

Published Aug 11, 2009

Tracked Since Feb 18, 2026