Executive brief
Flash Slideshow Maker Professional is a software tool used to create animated photo slideshows. A security flaw in its registration system allows a local user to take full control of the computer by entering a specially crafted, overly long string into the registration name or code fields. This could lead to a complete system compromise, allowing an attacker to run unauthorized programs or access sensitive data.
Technical details
A classic buffer overflow (CWE-120) exists in Flash Slideshow Maker Professional 5.20 within the 'Help > Register' dialog. The application fails to properly validate the length of input strings provided in the 'Name' and 'Code' fields. By supplying a specifically crafted payload that overwrites Structured Exception Handling (SEH) records, a local attacker can redirect execution flow. Successful exploitation allows for arbitrary code execution, such as triggering a reverse shell, with the privileges of the application (often system-level depending on the environment). Public exploit code is available.
Affected products
- Anvsoft Flash Slideshow Maker Professional 5.20
Timeline
- 2018-09-08: disclosed: Initial exploit code authored by Shubham Singh
- 2018-09-10: other: Exploit published on Exploit-DB
- 2026-05-25: advisory: NVD/VulnCheck advisory published