Exploit for Easy File Sharing Web Server SESSIONID Cookie Handling Buffer Overflow

saint · 2014-05-29

Description

Easy File Sharing Web Server SESSIONID Cookie Handling Buffer Overflow. Vulnerable to stack buffer overflow in SESSIONID cookie handling

Entry point

ParameterUserID · header

Path/vfolder.ghp

Stack-based buffer overflow via a long UserID cookie value in vfolder.ghp.

Affected Efssoft Easy File Sharing Web Server versions

Efssoft Easy File Sharing Web Server= 6.8

All known vulnerabilities by product

Easy File Sharing Web Server

CVSS 10.0 for CVE-2014-3791

10.0

HIGH SEVERITY

VectorAV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/

EPSS Score

78.7%higher than 99.5% of all CVEs

Updated 2026-07-20

Exploit Details

Modified:2014-05-29 00:00

Last Seen:2016-10-03 15:02

Reporter:SAINT Corporation

Tags

easy file sharing web serverbuffer overflowsessionid cookie

Other exploits for CVE-2014-3791

Exploit for Out-of-bounds Write in Adobe Acrobat

2019-12-20 WangGuixiuGITEE

Easy File Sharing Web Server SESSIONID Cookie Handling Buffer Overflow

2014-05-29 SAINT CorporationSAINT

Easy File Sharing Web Server SESSIONID Cookie Handling Buffer Overflow

2014-05-29 SAINT CorporationSAINT

Easy File Sharing Web Server SESSIONID Cookie Handling Buffer Overflow

2014-05-29 SAINT CorporationSAINT

Easy File Management Web Server Stack Buffer Overflow

2014-05-20 superkojiman, Julien Ahrens, TecR0c <roccogiovannicalvi@gmail.com>METASPLOITRuby

Easy File Sharing Web Server 6.8 - Remote Stack Buffer Overflow

2014-05-14 superkojimanEXPLOITDB

Exploit Code

MARKDOWN32 lines

## https://sploitus.com/exploit?id=SAINT:9749F79D880E1274B76A6B770C40DB0B
Added: 05/29/2014  
CVE: [CVE-2014-3791](<https://vulners.com/cve/CVE-2014-3791>)  
BID: [67406](<http://www.securityfocus.com/bid/67406>)  
OSVDB: [106965](<http://www.osvdb.org/106965>)  


### Background

Easy File Sharing Web Server is software that allows users to upload/download files to a server easily through a web browser, as well as providing a bulletin board system (forum). 

### Problem

Easy File Sharing Web Server is vulnerable to a stack buffer overflow condition as a result of not properly validating user-supplied input when handling a SESSIONID cookie. This allows a remote attacker to potentially execute arbitrary code. 

### Resolution

Install a fixed version when one becomes available. Alternatively, find a different software product solution. 

### References

<http://www.zerodaylab.com/vulnerabilities/CVE-2014/CVE-2014-3791.html>  
<http://blog.techorganic.com/2014/05/14/from-fuzzing-to-0-day/>  


### Limitations

Exploit works on Windows XP Professional SP2 and SP3. 

### Platforms

Windows