vendor:
by:
Unknown
7.5
CVSS
HIGH
Object Classid Exploit
119
CWE
Product Name:
Affected Version From:
Affected Version To:
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
2007
Object Classid Exploit
This exploit takes advantage of a vulnerability in the object classid attribute in HTML. By creating a specially crafted object element with a malicious classid, an attacker can trigger arbitrary code execution. In this specific example, the exploit is using VBScript to create a buffer overflow by manipulating the get_EAX and get_EBX variables. The crafted buffer is then passed to the ConnectAsyncEx method of the target object, leading to code execution.
Mitigation:
To mitigate this vulnerability, it is recommended to sanitize user input and validate any external data used in HTML elements. Additionally, disabling or restricting the execution of scripting languages like VBScript can help prevent exploitation.
