cbcvebase.
CVE-2010-2102
published 2010-05-27

CVE-2010-2102: Buffer overflow in Webby Webserver 1.01 allows remote attackers to execute arbitrary code via a long HTTP GET request.

PriorityP357critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
6.62%
93.0th percentile
Buffer overflow in Webby Webserver 1.01 allows remote attackers to execute arbitrary code via a long HTTP GET request.

Affected

1 ranges
VendorProductVersion rangeFixed in
timo_gaikwebby_webserver——

Detection & IOCsextracted from sources · hover to see the quote

commandGET http://<target>/<'A'*790 + '\x90'*4 + '\x42'*105> HTTP/1.0 ↗
bytes↗
41*790 + 90*4 + 42*105
  • →Detect oversized HTTP GET request URIs targeting Webby Webserver 1.01; the PoC sends a URI component of 899 bytes (790 'A's + 4 NOP bytes \x90 + 105 'B' bytes \x42) which is anomalously large and should trigger on any reasonable HTTP request-length threshold. ↗
  • →The exploit overwrites the Structured Exception Handler (SEH) chain via a long GET request. Monitor for SEH-based exploitation patterns (e.g., repeated identical byte sequences in the URI path) against Webby Webserver processes on Windows XP/98/ME. ↗
  • →Alert on HTTP GET requests where the URI path length exceeds ~800 bytes directed at Webby Webserver (default port as configured); the PoC uses a buffer of 899 bytes total in the path component. ↗
  • ·The PoC is a crash/DoS proof-of-concept only and does not include shellcode; it demonstrates SEH overwrite but does not achieve code execution by itself. Actual exploitation would require a working SEH bypass and shellcode substituted for the filler bytes. ↗
  • ·Affected platform is limited to Webby Webserver version 1.01 on Windows XP, Win 98, and Win ME only. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.