CVE-2008-6938
Pi3Web < 2.0.3_pl1 - Denial of Service via ISAPI Directory File Request
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2008-6938.
PoCs published by Hamid Ebadi, including Metasploit module auxiliary/dos/windows/http/pi3web_isapi.
AI-analyzed exploit summary This is a writeup describing a DoS vulnerability in Pi3Web <=2.0.3 caused by insufficient checks on ISAPI module requests. The server crashes when attempting to load a non-DLL file (e.g., users.txt) as a DLL.
Description
Pi3Web 2.0.3 before PL2, when installed on Windows as a desktop application and without using the Pi3Web/Conf/Intenet.pi3, allows remote attackers to cause a denial of service (crash or hang) and obtain the full pathname of the server via a request to a file in the ISAPI directory that is not an executable DLL, which triggers the crash when the DLL load fails, as demonstrated using Isapi\users.txt.
Exploits (2)
This is a writeup describing a DoS vulnerability in Pi3Web <=2.0.3 caused by insufficient checks on ISAPI module requests. The server crashes when attempting to load a non-DLL file (e.g., users.txt) as a DLL.
This Metasploit module exploits a DoS vulnerability in Pi3Web HTTP server by sending a request for an invalid DLL file in the /isapi directory, causing the service to crash.