CVE-2019-25689
HIGHHTML5 Video Player 1.2.5 Local Buffer Overflow Non-SEH
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2019-25689. PoCs published by Dino Covotsos.
AI-analyzed exploit summary This exploit demonstrates a local buffer overflow in HTML5 Video Player 1.2.5 by overwriting the buffer with a crafted payload containing a NOP sled, shellcode, and a JMP ESP address from shell32.dll. It generates an exploit.txt file that, when pasted into the application's registration key field, triggers the overflow and executes the shellcode.
Description
HTML5 Video Player 1.2.5 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by supplying an oversized key code string. Attackers can craft a malicious payload exceeding 997 bytes and paste it into the KEY CODE field in the Help Register dialog to trigger code execution and spawn a calculator process.
Exploits (1)
This exploit demonstrates a local buffer overflow in HTML5 Video Player 1.2.5 by overwriting the buffer with a crafted payload containing a NOP sled, shellcode, and a JMP ESP address from shell32.dll. It generates an exploit.txt file that, when pasted into the application's registration key field, triggers the overflow and executes the shellcode.
References (3)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H