CVEs-PoC/2012/CVE-2012-10058.md

### [CVE-2012-10058](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-10058)
![](https://img.shields.io/static/v1?label=Product&message=R4%20Embedded%20Server&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=1.25%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-121%20Stack-based%20Buffer%20Overflow&color=brightgreen)

### Description

RabidHamster R4 v1.25 contains a stack-based buffer overflow vulnerability due to unsafe use of sprintf() when logging malformed HTTP requests. A remote attacker can exploit this flaw by sending a specially crafted URI, resulting in arbitrary code execution under the context of the web server process.

### POC

#### Reference
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/rabidhamster_r4_log.rb
- https://www.exploit-db.com/exploits/18929
- https://www.vulncheck.com/advisories/rabidhamster-r4-log-entry-buffer-overflow

#### Github
No PoCs found on GitHub currently.