CVE-2009-4108

XM Easy Personal FTP Server - 'APPE' / 'DELE' Denial of Service

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2009-4108 has a selected CVSS score of 4.0; EIP currently links 2 catalogued exploits.

Description

XM Easy Personal FTP Server 5.8.0 allows remote authenticated users to cause a denial of service (crash) by uploading or creating a large number of files or directories, then performing a LIST command.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
2

Proofs of concept

2

Catalogued exploits

ExploitDBXM Easy Personal FTP Server - 'APPE' / 'DELE' Denial of ServiceExploitDB exploitby zhangmcExploit1 file

linked to 2 vulnerabilities

ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The Python script implements a denial-of-service exploit against XM Easy Personal FTP Server 5.8.0 by sending an APPE command on one connection and a DELE command on a second connection, as described in CVE-2009-4048.

Backdoor review

No backdoor observed in reviewed code

The Python script is a straightforward proof-of-concept for CVE-2009-4048. It opens two FTP control connections, issues an APPE command on the first, closes it, then issues a DELE command on the second to trigger a denial of service. No backdoor, trojan, or deceptive behavior is present.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesPython
Target softwareXM Easy Personal FTP Server
Attack typesDenial of Service
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends crafted FTP commands (APPE and DELE) to trigger a denial-of-service condition, which is the definition of an exploit.

exploits/windows/dos/10104.py:42exploits/windows/dos/10104.py:66

Requirements

  • Valid FTP credentials (username and password) for the target server.exploits/windows/dos/10104.py:6-7
  • Network connectivity to the target FTP server on port 21.exploits/windows/dos/10104.py:19

Observed behavior

  • Authenticates to the FTP server using supplied credentials.exploits/windows/dos/10104.py:25-32
  • Sends an APPE command with a single character argument on the first connection.exploits/windows/dos/10104.py:42
  • Closes the first connection and opens a second authenticated connection.exploits/windows/dos/10104.py:47-64
  • Sends a DELE command with the same single character argument on the second connection.exploits/windows/dos/10104.py:66
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
Payload withheldStandard for an FTP exploit PoCexploits/windows/dos/10104.py:19
Network Connection
Payload withheldUsed for active FTP data transfer, consistent with the PORT commandexploits/windows/dos/10104.py:34
Ftp Command
Payload withheldImplements the described denial-of-service triggerexploits/windows/dos/10104.py:42exploits/windows/dos/10104.py:66
Review boundaries

What the analysis did not establish

  • Only the exploit script was analyzed; no external dependencies or target server were inspected.
  • The script's effectiveness or reliability was not tested.
  • Only the supplied text file was reviewed; no binary files or external resources were inspected.
  • The script's effect on a live target was not verified.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

ExploitDBXM Easy Personal FTP Server 5.8.0 - Remote Denial of ServiceExploitDB exploitby leinakesiExploit1 file

linked to 2 vulnerabilities

ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that authenticates to an FTP server and creates 2000 directories via MKD commands to trigger a denial-of-service crash when a subsequent LIST command is issued.

Backdoor review

No backdoor observed in reviewed code

The supplied text is a plain Python script that automates FTP MKD commands to create many directories, intended to trigger a denial-of-service in XM Easy Personal FTP Server. No backdoor, trojan, or deceptive payload is present. The script performs only the advertised DoS behavior.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesPython
Target softwareXM Easy Personal FTP Server 5.8.0
Attack typesDenial of Service
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete Python script that actively creates 2000 directories on a target FTP server to trigger a crash, which is the definition of exploit code exercising a vulnerability.

exploits/windows/dos/10221.txt:36-114

Requirements

  • Valid FTP credentials (username and password) for the target server.exploits/windows/dos/10221.txt:48-49
  • Network connectivity to the target FTP server on port 21.exploits/windows/dos/10221.txt:51-53

Observed behavior

  • Connects to the target FTP server on port 21.exploits/windows/dos/10221.txt:51-53
  • Sends USER and PASS commands to authenticate.exploits/windows/dos/10221.txt:58-60
  • Creates 2000 directories using MKD commands with incrementally longer names.exploits/windows/dos/10221.txt:62-111
  • Closes the connection after creating directories.exploits/windows/dos/10221.txt:113
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Script Behavior
Payload withheldThis matches the described denial-of-service technique of uploading many files/folders to crash the server.exploits/windows/dos/10221.txt:36-114
Review boundaries

What the analysis did not establish

  • The script creates directories but does not include the final LIST command that triggers the crash; the user must perform that step manually.
  • The script uses hardcoded loops of 199 iterations each (10 loops) for a total of 1990 directories, not exactly 2000 as described in the text.
  • Only the supplied text file was reviewed; no external resources or referenced tools were inspected.
  • The script is not executed, so dynamic behavior cannot be confirmed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

5