Vulners
Lucene search
Budabot 4.0 - Denial of Service (PoC)
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | Budabot 4.0 Denial Of Service Vulnerability | 17 Nov 201800:00 | – | zdt |
| Budabot 4.0 - Denial of Service Exploit | 3 Dec 201800:00 | – | zdt |
 | Budabot Denial of Service Vulnerability | 19 Nov 201800:00 | – | cnvd |
 | CVE-2018-19290 | 30 Nov 201818:00 | – | cve |
 | CVE-2018-19290 | 30 Nov 201818:00 | – | cvelist |
 | EUVD-2018-10992 | 7 Oct 202500:30 | – | euvd |
 | Budabot 4.0 - Denial of Service (PoC) | 3 Dec 201800:00 | – | exploitpack |
 | CVE-2018-19290 | 30 Nov 201818:29 | – | nvd |
 | Budabot 4.0 Denial Of Service | 16 Nov 201800:00 | – | packetstorm |
 | Command injection | 30 Nov 201818:29 | – | prion |
10
# Exploit Title: Budabot 4.0 - Denial of Service (PoC)
# Date: 2018-10-15
# Exploit Author: Ryan Delaney
# Author Contact: [email protected]
# Vendor Homepage: http://budabot.com/
# Software Link: http://budabot.com/forum/viewtopic.php?f=8&t=1413
# Version: 0.6 -> 4.0
# Tested on: 4.0
# CVE: CVE-2018-19290
# 1. Description
# In modules/HELPBOT_MODULE in Budabot 0.6 through 4.0, lax syntax validation
# allows remote attackers to perform a command injection attack against the
# PHP daemon with a crafted command, resulting in a denial of service or
# possibly unspecified other impact. In versions before 3.0,
# modules/HELPBOT_MODULE/calc.php has the vulnerable code; in 3.0 and above,
# modules/HELPBOT_MODULE/HelpbotController.class.php has the vulnerable code.
# 2. Proof of Concept
Start the Budabot listener, set valid configuration options, and wait for
the chatbot to announce it's ready in-game.
Send the chatbot a private message containing "!calc 5 x 5", and the
Budabot listener will terminate.Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
03 Dec 2018 00:00Current
9.6High risk
Vulners AI Score9.6
CVSS 27.5
CVSS 39.8
EPSS0.02698