CVE-2008-6938 Pi3Web 2.0.3 before PL2, when installed on Windows as a desktop application and without using the Pi3Web/Conf/Intenet.pi3, allows remote attackers to cause a denial of service (crash or hang) and obta...
MediumCVSS 4.3
EPSS 26.5%
Framework module
PoC
- Published
- Updated
- Exploit status
- Public exploit available
Description
Pi3Web 2.0.3 before PL2, when installed on Windows as a desktop application and without using the Pi3Web/Conf/Intenet.pi3, allows remote attackers to cause a denial of service (crash or hang) and obtain the full pathname of the server via a request to a file in the ISAPI directory that is not an executable DLL, which triggers the crash when the DLL load fails, as demonstrated using Isapi\users.txt.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| holger zimmermann pi3web | <= 2.0.3_pl1 | No fix listed |
| holger zimmermann pi3web | = 1.0.1 | No fix listed |
| holger zimmermann pi3web | = 2.0 | No fix listed |
| holger zimmermann pi3web | = 2.0.1 | No fix listed |
| holger zimmermann pi3web | = 2.0.2_beta_1 | No fix listed |
References
- 20081122 Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability mailing-list
- 32696 third-party-advisory vendor-advisory
- 49998 exploit vdb-entry
- 49999 vdb-entry
- 20081122 Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability mailing-list
- 20081124 Re: Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability mailing-list
- 20081130 Re: Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability mailing-list
- 20081201 Re: Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability mailing-list
- 20081203 Re: Re: Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability exploit mailing-list
- 32287 exploit patch vdb-entry
- pi3web-isapi-dos(46600) vdb-entry
- 7109 exploit