BlackMoon FTP Server 3.1.2.1731 unquoted search path

Summaryinfo

A vulnerability classified as problematic was found in BlackMoon FTP Server 3.1.2.1731. Impacted is an unknown function. Such manipulation leads to unquoted search path. This vulnerability is listed as CVE-2019-25306. The attack must be carried out locally. In addition, an exploit is available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in BlackMoon FTP Server 3.1.2.1731. Affected by this issue is an unknown function. The manipulation with an unknown input leads to a unquoted search path vulnerability. Using CWE to declare the problem leads to CWE-428. The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. Impacted is confidentiality, integrity, and availability. CVE summarizes:

BlackMoon FTP Server 3.1.2.1731 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted binary path in the service configuration to insert malicious code that would execute with LocalSystem account permissions during service startup.

The weakness was presented by Debashis Pal as 47521. The advisory is shared for download at exploit-db.com. This vulnerability is handled as CVE-2019-25306 since 02/10/2026. The exploitation is known to be difficult. The attack needs to be approached locally. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1574.009.

The exploit is available at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (47521). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• File Transfer Software

Vendor

• BlackMoon

Name

• FTP Server

Version

• 3.1.2.1731

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion