Attack Chain

1. The attacker gains local access to a system with Flash Slideshow Maker Professional 5.20 installed.
2. The attacker crafts a malicious payload designed to exploit a buffer overflow when processed by the application.
3. The attacker opens the Flash Slideshow Maker Professional application.
4. The attacker navigates to the “Help > Register” dialog within the application.
5. The attacker pastes the crafted malicious payload into the “Name” and “Code” fields of the registration dialog.
6. The attacker triggers the registration process, causing the application to process the malicious payload without proper size validation.
7. The buffer overflow occurs, overwriting memory and hijacking control flow via structured exception handling (SEH).
8. The attacker gains a reverse shell with system privileges on the compromised system.

Impact

Successful exploitation of this buffer overflow vulnerability (CVE-2018-25377) allows a local attacker to execute arbitrary code with system-level privileges. This grants the attacker full control over the affected system, enabling them to install malware, steal sensitive data, or perform other malicious activities. This vulnerability poses a significant risk to any system running the affected version of Flash Slideshow Maker Professional 5.20.

Recommendation

• Apply appropriate input validation to the Name and Code fields.
• Monitor process creations for suspicious child processes of Flash Slideshow Maker Professional using the process creation rule below.
• Monitor for unexpected network connections originating from the Flash Slideshow Maker Professional process using the network connection rule below.