| शीर्षक | D-Link DIR-513 v1.0 Buffer Overflow |
|---|
| विवरण | A stack-based buffer overflow vulnerability exists in the function formLanguageChange of the Boa web server, which is used to implement the web-based management interface in the DIR-513 embedded device.
This vulnerability is triggered when a remote attacker sends a specially crafted POST request to the endpoint /goform/formLanguageChange. The vulnerable function retrieves the parameter curTime from the request body and then uses it in a call to sprintf():
sprintf(v12, "%s?t=%s", "/index.asp", v8);
Here, v8 is derived from the input curTime . Since the length of curTime is not properly validated before being used in sprintf, an attacker can supply an excessively long value, leading to a stack buffer overflow. |
|---|
| स्रोत | ⚠️ https://github.com/boyslikesports/vul/blob/main/formLanguageChange.md |
|---|
| उपयोगकर्ता | Weining Xiao (UID 88216) |
|---|
| सबमिशन | 22/07/2025 08:45 AM (1 वर्ष पहले) |
|---|
| संयम | 25/07/2025 08:52 AM (3 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 317573 [D-Link DIR-513 1.0 HTTP POST Request formLanguageChange curTime बफ़र ओवरफ़्लो] |
|---|
| अंक | 20 |
|---|