I saw a posting a month or 2 ago for a BOF in an FTP server belonging to EFS Software here: http://www.securityfocus.com/bid/19243 At first there was no additional details provided and I hunted up and down before finding it after some fuzzing (stack smash in password). While on the hunt, I found one not listed. Easy file sharing web server - XSS in forum messages. Its persistent XSS. Don't see that much these days. The BB code (which looks suspiciously like it was lifted from PHPBB) fails to filter javascript and other html attributes from the posts. Example exploit in test message: [IMG]testing123" onmouseover="alert('10000')">[/IMG] Peeking inside with IDA, we see why: .data:0055D61C ; char aImgSrcSBorde_0[] .data:0055D61C aImgSrcSBorde_0 db '<img src=%s border=0>',0 ; DATA XREF: sub_41B930+49F .data:0055D61C ; sub_41FC10+6B2 ... Following the subroutine, there's no real formatting or escaping done. I mean the forum posting does attempt some form of filtering, but its bypassed easily.
