# Other Buffer Overflow in PHP of the AirMax Products

Unbounded strcpy of the multipart boundary header into a 100-byte stack buffer in AirMax's getpost() causes a remote stack buffer overflow via a crafted POST.

- Payout: hidden
- Severity: high
- Program: Ubiquiti Inc.
- Found by: rbran
- Disclosed: 2016-04-07
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/74004
- Library page: https://bugbountylibrary.com/r/h1%3A74004
- Tags: area:devices domain:iot impact:dos kind:bounty platform:hackerone sev:high tech:php technique:source-review vuln:memory-corruption vuln:rce

**Target:** lighttpd CGI handler (post.c/uploadbuffer.c) on AirMax devices
**Root cause:** getpost() copies the attacker-controlled multipart boundary value (mb+1) into a fixed 100-byte stack buffer `boundary` with strcpy, with no length check.
**Steps:**
1. Send a POST to /login.cgi with header `Content-Type: multipart/form-data; boundary=<long string>`
2. The boundary value exceeds 100 bytes and overflows the stack buffer `boundary` in getpost()
3. lighttpd logs `(mod_cgi.c.1319) cleaning up CGI: process died with signal 11` confirming the crash
4. Increase the number of `d` characters if a larger boundary is needed to trigger
**How found:** After a prior report (73491) on the same files, the researcher re-read post.c and uploadbuffer.c and spotted the unchecked strcpy of the boundary value into a fixed-size stack buffer.
**Exploitation:** Not weaponized in the report; author notes stack overflow on near-identical AirMax hardware makes RCE straightforward, but no exploit was written.
**Insight:** Multipart boundary parsing is a recurring overflow source: grep for strcpy/strcat of the value after 'boundary=' in embedded HTTP/CGI parsers, and test with oversized boundary strings rather than just malformed bodies.