Design/Logic Flaw

2008-04-1119:05:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

Low

0.528 Medium

EPSS

Percentile

97.6%

JSON

The IBizEBank.FIProfile.1 ActiveX control in fiprofile20.ocx in IBiz E-Banking Integrator (formerly IBiz OFX Integrator) 2.0.2932 exposes the unsafe WriteOFXDataFile method, which allows remote attackers to overwrite arbitrary files via a full pathname in the argument. NOTE: some of these details are obtained from third party information.

CPENameOperatorVersion
ibiz_e-banking_integratoreq2.0.2932

CPE	Name	Operator	Version
	ibiz_e-banking_integrator	eq	2.0.2932

References

secunia.com/advisories/29758

www.osvdb.org/44393

www.securityfocus.com/bid/28700

exchange.xforce.ibmcloud.com/vulnerabilities/41752

www.exploit-db.com/exploits/5416