| タイトル | DefaultFuction CRM V2.0 Buffer Overflow |
|---|
| 説明 | The CRM system contains multiple stack buffer overflow vulnerabilities. The root cause is the use of the unsafe gets() function in the customer search module, which does not perform any length checking on input. Attackers can input malicious data exceeding 64 bytes in the "Search Customer" feature, precisely overwriting the return address on the stack (at an offset of 84 bytes), thereby hijacking the program control flow to jump to malicious code execution and ultimately gain system Shell access. This vulnerability can be exploited remotely (in network-deployed versions), allowing attackers to gain complete control over the target server, leading to severe consequences such as data breaches and system compromise. It is strongly recommended to immediately replace gets() with fgets() and enable compilation protection mechanisms.
|
|---|
| ソース | ⚠️ https://github.com/DefaultFuction/Customer-Relationship-Management-In-C-Project/issues/1 |
|---|
| ユーザー | Practice (UID 95611) |
|---|
| 送信 | 2026年06月28日 17:09 (2 月 ago) |
|---|
| モデレーション | 2026年08月15日 14:05 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 390704 [DefaultFuction Customer-Relationship-Management-In-C-Project 2.0 Customer Search gets メモリ破損] |
|---|
| ポイント | 20 |
|---|