by Kastro
Paper/Archive/CVE-2018-25223

CVE-2018-25223

crashmail Crashmail — Crashmail 1.6 Stack-based Buffer Overflow Remote Code Execution

EPSS 0.9%public exploitCVSS 9.8
critical.is priorityof 100
52
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 60.9.609 × 2012.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Crashmail 1.6 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by sending malicious input to the application. Attackers can craft payloads with ROP chains to achieve code execution in the application context, with failed attempts potentially causing denial of service.

Affected

ProductAffectedFixed inSource
Crashmail1.6–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitexploit-db.com/exploits/44331refftnapps.sourceforge.net/crashmail.htmlrefexploitpack.comwriteupvulncheck.com/advisories/crashmail-stack-based-buffer-overflow-remote-code-execution