| शीर्षक | DefaultFuction CRM V2.0 Buffer Overflow |
|---|
| विवरण | The CRM system contains multiple stack buffer overflow vulnerabilities. The root cause is the use of the unsafe gets() function in the customer search module, which does not perform any length checking on input. Attackers can input malicious data exceeding 64 bytes in the "Search Customer" feature, precisely overwriting the return address on the stack (at an offset of 84 bytes), thereby hijacking the program control flow to jump to malicious code execution and ultimately gain system Shell access. This vulnerability can be exploited remotely (in network-deployed versions), allowing attackers to gain complete control over the target server, leading to severe consequences such as data breaches and system compromise. It is strongly recommended to immediately replace gets() with fgets() and enable compilation protection mechanisms.
|
|---|
| स्रोत | ⚠️ https://github.com/DefaultFuction/Customer-Relationship-Management-In-C-Project/issues/1 |
|---|
| उपयोगकर्ता | Practice (UID 95611) |
|---|
| सबमिशन | 28/06/2026 05:09 PM (2 महीनों पहले) |
|---|
| संयम | 15/08/2026 02:05 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 390704 [DefaultFuction Customer-Relationship-Management-In-C-Project 2.0 Customer Search gets बफ़र ओवरफ़्लो] |
|---|
| अंक | 20 |
|---|