CVE-2018-25221

CRITICAL

EChat Server 3.1 Buffer Overflow via chat.ghp username Parameter

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-25221. PoCs published by Juan Sacco.

AI-analyzed exploit summary This exploit targets a buffer overflow vulnerability in Easy Chat Server v3.1 via the 'username' parameter in the 'chat.ghp' endpoint. It constructs a malicious HTTP GET request with a crafted payload containing a NOP sled, SEH overwrite, and shellcode to achieve remote code execution.

Description

EChat Server 3.1 contains a buffer overflow vulnerability in the chat.ghp endpoint that allows remote attackers to execute arbitrary code by supplying an oversized username parameter. Attackers can send a GET request to chat.ghp with a malicious username value containing shellcode and ROP gadgets to achieve code execution in the application context.

Exploits (1)

exploitdb WORKING POC

by Juan Sacco · pythonremotewindows

https://www.exploit-db.com/exploits/44155

View Code ZIP pw:eip

This exploit targets a buffer overflow vulnerability in Easy Chat Server v3.1 via the 'username' parameter in the 'chat.ghp' endpoint. It constructs a malicious HTTP GET request with a crafted payload containing a NOP sled, SEH overwrite, and shellcode to achieve remote code execution.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Easy Chat Server v3.1

No auth needed

Prerequisites: Network access to the target server · Target server running Easy Chat Server v3.1

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

devstral-2 · analyzed Apr 08, 2026 Full analysis →

References (2)

Core 2

Core References

Exploit exploit

ExploitDB-44155

https://www.exploit-db.com/exploits/44155

Third Party Advisory third-party-advisory

VulnCheck Advisory: EChat Server 3.1 Buffer Overflow via chat.ghp username Parameter

https://www.vulncheck.com/advisories/echat-server-buffer-overflow-via-chat-ghp-username-parameter

Scores

CVSS v3 9.8

EPSS 0.0082

EPSS Percentile 52.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-787

Status published

Products (2)

echatserver/easy_chat_server < 3.1

Echatserver/EChat Server 3.1

Published Mar 28, 2026

Tracked Since Mar 29, 2026