vendor:
Persits Software Inc
by:
2009
an attacker is able to write arbitrary files to arbitrary locations on disk. Code execution occurs by writing to the All Users Startup Programs directory. You may want to combine this module with the use of multi/handler since a user would have to log for the payload to execute."
CVSS
7.5
Directory Traversal
CVE-2009-3693
CWE
Product Name: Persits Software Inc
Affected Version From: NO
Affected Version To: 3.0.0.3
Patch Exists: Apply the patch provided by the vendor.
Related CWE: jduck
CPE: 3.0.0.3
Metasploit:
https://www.exploit-db.com/raw/16598
Platforms Tested: XUpload ActiveX
HIGH
Persits XUpload ActiveX MakeHttpRequest Directory Traversal
This module exploits a directory traversal in Persits Software Inc's XUpload ActiveX control(version 3.0.0.3) that's included in HP LoadRunner 9.5. By passing a string containing ".." sequences to the MakeHttpRequest method
Mitigation:
22
