EUVD-2025-21030
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Lifecycle Timeline
4Description
A stack-based buffer overflow vulnerability exists in Easy File Sharing HTTP Server version 7.2. The flaw is triggered when a crafted POST request is sent to the /sendemail.ghp endpoint containing an overly long Email parameter. The application fails to properly validate the length of this field, resulting in a memory corruption condition. An unauthenticated remote attacker can exploit this to execute arbitrary code with the privileges of the server process.
Analysis
Easy File Sharing HTTP Server version 7.2 contains a stack-based buffer overflow triggered by an oversized Email parameter in POST requests to /sendemail.ghp. Unauthenticated attackers can exploit this for remote code execution on the Windows server.
Technical Context
The /sendemail.ghp endpoint processes the Email POST parameter without bounds checking. An overly long value overflows a stack buffer, overwriting the return address. An attacker can redirect execution to shellcode embedded in the HTTP request.
Affected Products
['Easy File Sharing HTTP Server 7.2']
Remediation
Replace with a maintained file sharing solution. If the application must remain, restrict access to trusted networks. Enable DEP and ASLR on the Windows host.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today