| 标题 | DefaultFuction CRM V2.0 Buffer Overflow |
|---|
| 描述 | The CRM system contains multiple stack buffer overflow vulnerabilities. The root cause is the use of the unsafe gets() function in the customer search module, which does not perform any length checking on input. Attackers can input malicious data exceeding 64 bytes in the "Search Customer" feature, precisely overwriting the return address on the stack (at an offset of 84 bytes), thereby hijacking the program control flow to jump to malicious code execution and ultimately gain system Shell access. This vulnerability can be exploited remotely (in network-deployed versions), allowing attackers to gain complete control over the target server, leading to severe consequences such as data breaches and system compromise. It is strongly recommended to immediately replace gets() with fgets() and enable compilation protection mechanisms.
|
|---|
| 来源 | ⚠️ https://github.com/DefaultFuction/Customer-Relationship-Management-In-C-Project/issues/1 |
|---|
| 用户 | Practice (UID 95611) |
|---|
| 提交 | 2026-06-28 17時09分 (2 月前) |
|---|
| 管理 | 2026-08-15 14時05分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 390704 [DefaultFuction Customer-Relationship-Management-In-C-Project 2.0 Customer Search gets 内存损坏] |
|---|
| 积分 | 20 |
|---|