rAthena vulnerabilities

rAthena prior to commit 0d89ae0 has a SQL Injection in the PartyBooking component via the WorldName parameter. Commit 0d89ae0 fixes the issue.

In rAthena versions prior to commit 2f5248b, a heap-based buffer overflow exists in the login server; a remote attacker can overwrite adjacent session fields by sending a crafted CA_SSO_LOGIN_REQ with an oversized token length. This leads to immediate denial of service (crash) and remote code execution is possible via heap corruption. Commit 2f5248b fixes the issue.

In rAthena versions prior to commit af2f3ba, a use-after-free vulnerability exists in the RODEX functionality of the map-server. An unauthenticated attacker can exploit this in a specific attack scenario to cause a denial of service by crashing the map-server.

rAthena is an open-source cross-platform MMORPG server. Versions prior to commit 0cc348b are missing a bound check in chclif_parse_moveCharSlot that can result in reading and writing out of bounds using input from the user.