Sambar 6 Search Results Buffer Overflow

vendor:

Sambar Server

by:

hdm, Andrew Griffiths, patrick

7.5

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: Sambar Server

Affected Version From: Sambar 6

Affected Version To: Sambar 6

Patch Exists: NO

Related CWE: CVE-2004-2086

CPE: a:sambar:sambar_server:6

Metasploit:

Other Scripts:

Platforms Tested: Windows

2004

Sambar 6 Search Results Buffer Overflow

This module exploits a buffer overflow found in the /search/results.stm application that comes with Sambar 6. This code is a direct port of Andrew Griffiths's SMUDGE exploit, the only changes made were to the nops and payload. This exploit causes the service to die, whether you provided the correct target or not.

Mitigation:

Apply the latest patches provided by the vendor.

Source

Exploit-DB raw data:

<!DOCTYPE html>
<html lang="en" xmlns="http://www.w3.org/1999/xhtml">
<head>
<link rel="stylesheet" href="https://cdn.sucuri.net/sucuri-firewall-block.css" />
<section class="center clearfix">
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>Sucuri WebSite Firewall - Access Denied</title>
<link href="https://fonts.googleapis.com/css?family=Open+Sans:400,300,600,700" rel="stylesheet" type="text/css">
</head>
<body>
<div id="main-container">
<header class="app-header clearfix">
<div class="wrap">
<a href="https://www.sucuri.net/?utm_source=firewall_block" class="logo"></a>
<span class="logo-neartext">Website Firewall</span>
<a href="https://sucuri.net/?utm_source=firewall_block" class="site-link">Back to sucuri.net</a>
</div>
</header>

<section class="app-content clearfix">
<div class="box">
<p class="medium-text">This page you are trying to visit is protected by an automated security check. Please complete the check below to verify your browser and proceed.</p>

<style>
.cap-spin{width:20px;height:20px;border:2px solid #d7ede0;border-top-color:#2e7d32;border-radius:50%;display:inline-block;animation:capspin .7s linear infinite;}
@keyframes capspin{to{transform:rotate(360deg);}}
#cap-widget:focus{outline:2px solid #b9c7ff;outline-offset:2px;}
</style>
<script>
var _cs="35831efa2a75a531fb58e784e79deb1a";
var _cd=4;
var _ce=1786450050;
var _cg="851759bafca1a98e3ea513c39a9ff715d729b0045c22fb9d5c06f3f7b87c818c";
var _capBusy=false;
function _hex(b){return Array.from(new Uint8Array(b)).map(function(x){return x.toString(16).padStart(2,'0');}).join('');}
async function _sha(s){return _hex(await crypto.subtle.digest('SHA-256',new TextEncoder().encode(s)));}
function _capState(s){var i=document.getElementById('cap-ind'),l=document.getElementById('cap-label'),w=document.getElementById('cap-widget');if(s==='verifying'){i.innerHTML='<span class="cap-spin"></span>';l.textContent='Verifying...';w.style.cursor='default';}else if(s==='done'){i.innerHTML='<svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="#2e7d32" stroke-width="3" stroke-linecap="round" stroke-linejoin="round"><polyline points="20 6 9 17 4 11"></polyline></svg>';l.textContent="You're a human";w.style.cursor='default';w.setAttribute('aria-checked','true');}}
async function capSolve(){if(_capBusy)return;_capBusy=true;_capState('verifying');var _t0=Date.now();var p=Array(_cd+1).join('0');var n=0;while(true){var h=await _sha(_cs+n);if(h.slice(0,_cd)===p){break;}n++;}document.getElementById('cap-token').value=_cs+':'+_cd+':'+_ce+':'+_cg+':'+n;var _w=800-(Date.now()-_t0);if(_w<0)_w=0;setTimeout(function(){_capState('done');var b=document.getElementById('cap-proceed');if(b){b.disabled=false;b.style.opacity='1';b.style.cursor='pointer';b.focus();}},_w);}
</script>
</br></br>
<form method="post" id="captchaform">
<input type="hidden" name="cap-token" id="cap-token" value="" />
<div id="cap-widget" role="checkbox" aria-checked="false" tabindex="0" onclick="capSolve()" onkeydown="if(event.key==='Enter'||event.key===' '){event.preventDefault();capSolve();}" style="display:inline-flex;align-items:center;gap:12px;background:#fff;border:1px solid #d3d3d3;border-radius:8px;padding:14px 18px;min-width:260px;cursor:pointer;box-shadow:0 1px 2px rgba(0,0,0,0.08);text-align:left;">
<span id="cap-ind" style="width:24px;height:24px;flex:0 0 24px;display:inline-flex;align-items:center;justify-content:center;"><span style="width:22px;height:22px;border:2px solid #c2c2c2;border-radius:4px;box-sizing:border-box;display:inline-block;"></span></span>
<span id="cap-label" style="flex:1;font-size:15px;color:#333;">Verify you&#39;re human</span>
</div>
<div><button type="submit" id="cap-proceed" class="btn btn-primary ajax-form brand-font" disabled style="margin-top:16px;opacity:.5;cursor:not-allowed;">Click to Proceed to Page</button></div>
</form>
</br></br>
<p class="what-is-firewall">
<a href="https://sucuri.net/website-firewall/?utm_source=firewall_block">Sucuri Website Firewall</a> is a cloud-based protection that
stands between your site and the rest of the world and protects against attacks,
malware infections, DDOS, brute force attempts and mostly anything that can harm it.</p>
</div>
</section>

<footer>
<span>&copy; 2026 Sucuri Inc. All rights reserved.</span>
<span id="privacy-policy"><a href="https://sucuri.net/privacy-policy?utm_source=firewall_block" target="_blank" rel="nofollow noopener">Privacy</a></span>
</footer>
</div>
</body>
</html>