Weeny Audio Cutter Software 1.5 Content Injection

Content-Injection Phishing Vulnerability

Technical Details:
=================
Vulnerability Title: Audio Cutter Content-Injection Phishing Vulnerability

Technical Details:
=================
Vulnerability Title: Audio Cutter Software - Content-Injection Phishing
Vulnerability
Tool Name: Weeny Audio Cutter Software v1.5
Critical Level: Low
Type: Local
Author: Ajay Gowtham aka AJOXR (Blackhat forums)
Type: Software Security Bug
Product Download: http://www.weenysoft.com/free-audio-cutter.html

Overview of Content-Injection Phishing Vulnerability:
=====================================================
Content-Injection Phishing describes the situation where hackers replace
part of the content of a legitimate site with false content designed to
mislead or misdirect the user into giving up their confidential information
to the hacker. For example, hackers may insert malicious code to log user's
credentials or an overlay which can secretly collect information and
deliver it to the hacker's phishing server.

Technical Impact:
=================
Once the injection is performed by an attacker, when ever next an user
uninstalls the vulnerable product from their system could lead to
Content-Injection phishing attack which allows user to collect any
sensitive information and or deliver feedback form based webpage to gather
their personal information.

In this software, affected file "unins000.exe" which fetches file from
insecure library and loads the content. where an attacker can able to
inject the malicious content. which might be phishing, tabnabbing or spear
phishing attacks etc. This allows attacker to gather user information by
convencing with fall prey content such as., Win movie tickets, discout
coupons etc.

Vulnerability Overview:
=======================
The software does not neutralize or incorrectly neutralizes
user-controllable input before it is placed in output that is used as a web
page that is served to the users.

Solution:
=========
The file (i.e., "unins000.exe") should sanitize the fetching .htm documents
from installed location, in case any user injects the code malicious code
should be cross verified for program integrity to avoid content
misplacement.

PoC:
====
https://youtu.be/7Ar00dc1XME