PMSoftware Simple Web Server 2.2 rc2 vsprintf stack-based overflow

Summaryinfo

A vulnerability was found in PMSoftware Simple Web Server 2.2 rc2. It has been classified as critical. This vulnerability affects the function vsprintf. The manipulation leads to stack-based overflow. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is traded as CVE-2012-10053. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

Detailsinfo

A vulnerability was found in PMSoftware Simple Web Server 2.2 rc2 and classified as critical. This issue affects the function vsprintf. The manipulation with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Simple Web Server 2.2 rc2 contains a stack-based buffer overflow vulnerability in its handling of the Connection HTTP header. When a remote attacker sends an overly long string in this header, the server uses vsprintf() without proper bounds checking, leading to a buffer overflow on the stack. This flaw allows remote attackers to execute arbitrary code with the privileges of the web server process. The vulnerability is triggered before authentication.

The weakness was shared by mr.pr0n. The advisory is shared at raw.githubusercontent.com. The identification of this vulnerability is CVE-2012-10053 since 08/08/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details as well as a public exploit are known.

The exploit is available at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Exploit-DB (19937) and EUVD (EUVD-2012-6582). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Web Server

Vendor

• PMSoftware

Name

• Simple Web Server

Version

• 2.2 rc2

Support

• end of life

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion