{"uuid": "e6408992-d66a-46ab-9da1-d22155f6b480", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5019", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/ultraminihttp_bof.rb", "content": "{\"aliases\": [], \"arch\": \"\", \"author\": [\"superkojiman\", \"PsychoSpy \", \"OJ Reeves \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a stack based buffer overflow in Ultra Mini HTTPD 1.21,\\n          allowing remote attackers to execute arbitrary code via a long resource name in an HTTP\\n          request. This exploit has to deal with the fact that the application's request handler\\n          thread is terminated after 60 seconds by a \\\"monitor\\\" thread. To do this, it allocates\\n          some RWX memory, copies the payload to it and creates another thread. When done, it\\n          terminates the current thread so that it doesn't crash and hence doesn't bring down\\n          the process with it.\", \"disclosure_date\": \"2013-07-10\", \"fullname\": \"exploit/windows/http/ultraminihttp_bof\", \"is_install_path\": true, \"mod_time\": \"2025-06-23 12:43:46 +0000\", \"name\": \"Ultra Mini HTTPD Stack Buffer Overflow\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/http/ultraminihttp_bof.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"windows/http/ultraminihttp_bof\", \"references\": [\"OSVDB-95164\", \"EDB-26739\", \"CVE-2013-5019\", \"BID-61130\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"v1.21 - Windows Server 2000\", \"v1.21 - Windows XP SP0\", \"v1.21 - Windows XP SP2/SP3\", \"v1.21 - Windows Server 2003 (Enterprise)\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:01.610877Z"}