Allok Video Converter Stack Overflow Vulnerability Allowing Arbitrary Code Execution

A stack overflow vulnerability has been identified in Allok Video Converter version 4.6.1217. The issue resides in the License Name input field, where attackers can inject malicious bytecode to overwrite Structured Exception Handling (SEH) handlers. This exploitation allows for the execution of arbitrary code, such as launching system commands. The vulnerability arises from improper input handling, leading to a buffer overflow that can be exploited to execute unauthorized code.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system.

Reproduction

To reproduce this vulnerability, copy the crafted payload into the License Name input field of Allok Video Converter version 4.6.1217. The injected bytecode will overwrite the SEH handlers, enabling the execution of the specified command, such as launching the calculator application.