SpotFTP Password Recover Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in SpotFTP Password Recover version 2.4.2. This vulnerability allows local attackers to crash the application by sending an oversized buffer in the Name field during the registration process. By generating a 256-byte payload and pasting it into the Name input field, attackers can trigger a crash when submitting the registration code.

Impact

Exploitation of this vulnerability leads to a crash of the SpotFTP Password Recover application, causing a denial-of-service condition.

Reproduction

To reproduce this vulnerability, first create a 256-byte payload consisting of repeated characters. Save this payload to a text file. Then, open SpotFTP Password Recover 2.4.2 and navigate to the registration section. Paste the 256-byte payload into the Name field, enter a registration code, and submit the form. The application will crash, demonstrating the denial-of-service vulnerability.