Submeter #454851: SourceCodester Student Record Management System in C++ with Source Code V1.0 Stack-based Buffer Overflow

The Student Record Management System contains a critical buffer overflow vulnerability, which manifests as follows:

Unrestricted User Input: In the cin >> data operation, there is no restriction on the length of input strings. This allows attackers to exploit this point by providing overly long inputs, leading to buffer overflow and memory corruption.
Fragile File Handling Logic: When processing overly long records, fixed-size buffers are used, resulting in memory corruption and subsequent illegal memory access (EXC_BAD_ACCESS).

The vulnerability could lead to the following severe outcomes:

Remote Code Execution (RCE): By crafting malicious inputs, attackers could overwrite return addresses or function pointers to control program execution flow.
Denial of Service (DoS): Overly long inputs directly cause the program to crash, rendering the service unavailable.
Data Integrity Violations: Overflows could corrupt or falsify the content of record files, jeopardizing the confidentiality and integrity of the data.

Vulnerability Impact

Exploitation Potential

Remote Code Execution:
Attackers can overwrite return addresses or control program execution flow by crafting malicious inputs, enabling:

Data theft
Privilege escalation
Full system compromise
Denial of Service (DoS):
Overly long inputs directly crash the program, causing prolonged service downtime.

Data Tampering and Leakage:
Attackers can manipulate or falsify file content, compromising data integrity and confidentiality.

• Fonte: ⚠️ https://github.com/TinkAnet/cve/blob/main/BOF.md
• Utilizador: Tinkanet (UID 52949)
• Submissão: 01/12/2024 19h43 (há 2 anos)
• Moderação: 04/12/2024 17h37 (3 days later)
• Estado: Duplicado
• Entrada VulDB: 284719 [SourceCodester Student Record Management System 1.0 View All Student Marks main Excesso de tampão]
• Pontos: 0