CVE-2019-25681
HIGHXlight FTP Server 3.9.1 SEH Overwrite Buffer Overflow
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2019-25681. PoCs published by Logan Whitmire.
AI-analyzed exploit summary This exploit demonstrates an SEH overwrite vulnerability in Xlight FTP Server 3.9.1 by generating a buffer overflow payload. The PoC creates a file with 428 'A' characters, which when pasted into the server configuration, triggers the crash and overwrites the SEH.
Description
Xlight FTP Server 3.9.1 contains a structured exception handler (SEH) overwrite vulnerability that allows local attackers to crash the application and overwrite SEH pointers by supplying a crafted buffer string. Attackers can inject a 428-byte payload through the program execution field in virtual server configuration to trigger a buffer overflow that corrupts the SEH chain and enables potential code execution.
Exploits (1)
This exploit demonstrates an SEH overwrite vulnerability in Xlight FTP Server 3.9.1 by generating a buffer overflow payload. The PoC creates a file with 428 'A' characters, which when pasted into the server configuration, triggers the crash and overwrites the SEH.
References (4)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H