3 ms·
How does that allow RCE?
by crehn 5y ago
How does that allow RCE?
- greyface- 5y agoBy manipulating values on the stack (notably, return address) in non-memory-safe languages: https://en.wikipedia.org/wiki/Uncontrolled_format_string https://en.wikipedia.org/wiki/Uncontrolled_format_string
- throwaway984393 5y agoAnd it's not as sexy, but if you can control the format string you can also inject things like SQL commands or HTTP headers into a convenient place. It's basically just an input validation exploit that in the right circumstances leads to other attacks.