AVS Audio Converter Stack Overflow Vulnerability Allowing Arbitrary Code Execution

A stack overflow vulnerability has been identified in AVS Audio Converter version 9.1.2.600. This vulnerability allows attackers to execute arbitrary code by manipulating the output folder text input. When the 'Browse' button is clicked, the crafted payload overwrites stack memory and triggers a bind shell on port 9999.

Impact

Exploitation of this vulnerability allows for arbitrary code execution with the privileges of the user running AVS Audio Converter.

Reproduction

To reproduce this vulnerability, first download and install AVS Audio Converter 9.1.2.600. After installation, open the application and locate the output folder text box. Copy a payload that exploits the buffer overflow vulnerability into this text box. When the 'Browse' button is clicked, the application will freeze, and a bind shell will be opened on port 9999.