Multiple Denial of Service Vulnerabilities in Easy Chat Server

vendor:

Easy Chat Server

by:

5.5

CVSS

MEDIUM

Denial of Service

CWE

Product Name: Easy Chat Server

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

Multiple Denial of Service Vulnerabilities in Easy Chat Server

Easy Chat Server is susceptible to multiple denial of service vulnerabilities. The application improperly sanitizes user supplied URI data and cannot handle large numbers of anonymous users created in chat rooms. An attacker with remote access to an affected instance of this application could use these vulnerabilities to crash the service, denying service to legitimate users.

Mitigation:

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/10649/info

It is reported that Easy Chat Server is susceptible to multiple denial of service vulnerabilities.

The chat software is implemented as a web server serving a chat web application to clients. The software is reported to contain two denial of service vulnerabilities. The application improperly sanitizes user supplied URI data, and cannot handle large numbers of anonymous users created in chat rooms.

An attacker with remote access to an affected instance of this application could use these vulnerabilities to crash the service, denying service to legitimate users.

An example of a long username URI:
http://www.example.com/chat.ghp?username=aaaa[ 295 of a ]aaaa&password=&room=1&sex=0

An example of creating a fake user:
http://www.example.com/chat.ghp?username=FakeUser&password=&room=1&sex=0