The functions that read data and unicode strings (32 bit size plus
data) are affected by a stack overflow during the copying of the input
data in a limited buffer trusting the size value provided by the
client.
Code execution may be possible if the attacker is able to modify the
memory after the input data (0x400 bytes) using other types of packets
and then sending a big string size for raising an invalid read
access exeption with the corrupted SEH:
The server is affected by a directory traversal vulnerability that
allows access (read, write and delete) to any file on the disk outside
the expected directory.
-------------------------------------
C] HmiLoad various Denials of Service
-------------------------------------
The server is affected by various problems that allow an attacker to
stop or crash it in various ways.
They are not much interesting and useful so it's not important to go
deeper in their details.
miniweb.exe is a program that listens on ports 80 and 443 when started.
Through the usage of encoded backslashes and directory traversal
patterns is possible to download the files outside the download
directory.
miniweb is affected by a weird vulnerability that allows an attacker to
crash the server due to the access to an arbitrary invalid memory zone
during the check of the extension of the requested file.
When it handles the HTTP POST requests it checks if the first byte of
the URI is equal to 0xfa in which case it considers the URI as a binary
sequence of data composed by two 32bit integer numbers used for taking
a new URI from the arbitrary memory address calculated on the second
number or on the sum of both:
