| Название | DefaultFuction CRM V2.0 Buffer Overflow |
|---|
| Описание | The CRM system contains multiple stack buffer overflow vulnerabilities. The root cause is the use of the unsafe gets() function in the customer search module, which does not perform any length checking on input. Attackers can input malicious data exceeding 64 bytes in the "Search Customer" feature, precisely overwriting the return address on the stack (at an offset of 84 bytes), thereby hijacking the program control flow to jump to malicious code execution and ultimately gain system Shell access. This vulnerability can be exploited remotely (in network-deployed versions), allowing attackers to gain complete control over the target server, leading to severe consequences such as data breaches and system compromise. It is strongly recommended to immediately replace gets() with fgets() and enable compilation protection mechanisms.
|
|---|
| Источник | ⚠️ https://github.com/DefaultFuction/Customer-Relationship-Management-In-C-Project/issues/1 |
|---|
| Пользователь | Practice (UID 95611) |
|---|
| Представление | 28.06.2026 17:09 (2 месяцы назад) |
|---|
| Модерация | 15.08.2026 14:05 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 390704 [DefaultFuction Customer-Relationship-Management-In-C-Project 2.0 Customer Search gets повреждение памяти] |
|---|
| Баллы | 20 |
|---|