Executive brief
ASPRunner Professional is a development tool used to generate ASP code and web applications from databases. A vulnerability in the software allows a local user to crash the application by entering an excessively long name when creating a new project. This results in a denial of service, preventing the user from using the software to build or manage web projects.
Technical details
A local buffer overflow vulnerability exists in ASPRunner Professional version 6.0.766 due to improper bounds checking on the 'Project name' input field. An attacker with local access to the application can trigger an out-of-bounds write (CWE-787) by pasting 180 or more characters into the project name field during the project creation wizard. This action causes a memory corruption that leads to an immediate application crash (Denial of Service). While the current exploit demonstrates a crash, buffer overflows of this nature can sometimes be leveraged for broader impact depending on memory protections in place. No official patch is currently noted in the advisory, though the vulnerability was disclosed via a public Proof of Concept.
Affected products
- Xlinesoft ASPRunner Professional 6.0.766
Timeline
- 2019-01-30: disclosed: Vulnerability discovered by Rafael Pedrero
- 2019-01-31: other: Proof of concept exploit published on Exploit-DB
- 2026-04-05: advisory: NVD/VulnCheck advisory published