qinguoyi TinyWebServer Stack-Based Buffer Overflow Vulnerability

A critical stack-based buffer overflow vulnerability has been identified in qinguoyi TinyWebServer versions through 1.0. The issue arises in the file '/http/http_conn.cpp', where the 'name' and 'password' fields, each 100 bytes in size, are vulnerable to overflow. The server improperly handles user input by copying it into these fields without any validation, allowing for a stack overflow condition. This vulnerability can be exploited remotely, without requiring authentication.

Impact

Exploitation of this vulnerability leads to a stack-based buffer overflow, a condition where the buffer being overwritten is allocated on the stack, potentially allowing for arbitrary code execution or causing a denial-of-service condition.

Reproduction

To reproduce this vulnerability, send a request that includes the 'name' and 'password' fields with crafted input that exceeds the buffer size. The server will read the input and copy it into the stack-based fields without proper checks, causing a buffer overflow.