CVE-2010-20112

published 2025-08-21

CVE-2010-20112: Amlib’s NetOpacs webquery.dll contains a stack-based buffer overflow vulnerability triggered by improper handling of HTTP GET parameters. Specifically, the…

Priority P2 63 critical 9.3 CVSS 4.0

AV N AC L AT N PR N UI N VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

EXPLOIT

Amlib’s NetOpacs webquery.dll contains a stack-based buffer overflow vulnerability triggered by improper handling of HTTP GET parameters. Specifically, the application fails to enforce bounds on input supplied to the app parameter, allowing excessive data to overwrite memory structures including the Structured Exception Handler (SEH). Additionally, malformed parameter names followed by an equals sign may result in unintended control flow behavior. This vulnerability is exposed through IIS and affects legacy Windows deployments

Affected

1 ranges

Vendor	Product	Version range	Fixed in
amlib	amlibweb_library_management_system	—	—

Detection & IOCs extracted from sources · hover to see the quote

path webquery.dll↗

url /webquery.dll?app=<oversized_string>↗

• → Monitor HTTP GET requests to webquery.dll where the 'app' parameter contains an abnormally long string — SEH overwrite vector for stack buffer overflow. ↗
• → Detect HTTP GET requests to webquery.dll containing an arbitrary parameter name immediately followed by an '=' sign with no recognized parameter name — secondary EIP overwrite vector. ↗

• · The vulnerability is exposed only when webquery.dll is deployed and accessible via IIS; non-IIS or non-Windows deployments are not affected. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-121