source: http://www.securityfocus.com/bid/24454/info Mbedthis AppWeb is prone to a format-string vulnerability because the application fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function. This issue affects only applications that were built with logging enabled and installed with no "ErrorLog" directive in 'appweb.conf'. Successful exploits may allow remote attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will likely crash the application, denying further service to legitimate users. AppWeb 2.2.2 is reported vulnerable; other versions may also be affected. 'GET %n://localhost:80/" request'
Related ExploitsTrying to match CVEs (1): CVE-2007-3009
Trying to match OSVDBs (1): 35510
Other Possible E-DB Search Terms: Mbedthis AppWeb 2.2.2, Mbedthis AppWeb
|2009-08-11||9411||Embedthis Appweb 3.0b.2-4 - Remote Buffer Overflow (PoC)||fl0 fl0w|
|2009-08-13||9429||EmbedThis Appweb 3.0B.2-4 - Multiple Remote Buffer Overflow (PoC)||Dr_IDE|
|2010-03-15||11763||Embedthis Appweb 3.1.2 - Remote Denial of Service||chr1x|