CVE-2007-4891
published 2007-09-14CVE-2007-4891: A certain ActiveX control in PDWizard.ocx 6.0.0.9782 and earlier in Microsoft Visual Studio 6.0 exposes dangerous (1) StartProcess, (2) SyncShell, (3) SaveAs…
PriorityP341medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EXPLOIT
EPSS
31.00%
98.0th percentile
A certain ActiveX control in PDWizard.ocx 6.0.0.9782 and earlier in Microsoft Visual Studio 6.0 exposes dangerous (1) StartProcess, (2) SyncShell, (3) SaveAs, (4) CABDefaultURL, (5) CABFileName, and (6) CABRunFile methods, which allows remote attackers to execute arbitrary programs and have other impacts, as demonstrated using absolute pathnames in arguments to StartProcess and SyncShell.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | visual_studio | — | — |
| microsoft | visual_studio | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect ActiveX instantiation of PDWizard.ocx in browser context, particularly calls to StartProcess() or SyncShell() methods with absolute path arguments, which indicate exploitation attempts. ↗
- →Monitor for invocation of the dangerous methods StartProcess, SyncShell, SaveAs, CABDefaultURL, CABFileName, and CABRunFile on the PDWizard ActiveX control from web content (e.g., Internet Explorer). ↗
- →Alert on child processes spawned by Internet Explorer (iexplore.exe) that originate from ActiveX method calls to PDWizard.ocx, as the PoC demonstrates arbitrary process execution via StartProcess(). ↗
- ·The vulnerability affects PDWizard.ocx version 6.0.0.9782 and earlier; detections should be scoped to this version range. ↗
- ·The PoC was tested specifically on Windows XP Professional SP2 with Internet Explorer 7; exploit behavior may differ on other OS/browser combinations. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft Visual Studio 6.0 - 'PDWizard.ocx' Remote Command Execution
exploitdb·2007-09-11
CVE-2007-4891 Microsoft Visual Studio 6.0 - 'PDWizard.ocx' Remote Command Execution
Microsoft Visual Studio 6.0 - 'PDWizard.ocx' Remote Command Execution
---
Microsoft Visual Studio 6.0 PDWizard (PDWizard.ocx
url: http://www.microsoft.com
author: shinnai
mail: shinnai[at]autistici[dot]org
site: http://shinnai.altervista.org
This was written for educational purpose. Use it at your own risk.
Author will be not responsible for any damage.
Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
greetz to: Wiz001 (be safe brotha... and see soon :D)
Description:
This ocx contains a lot of extreme dangerous methods. Theese two are very interesting, they are:
"StartProcess()" and "SyncShell()"
Using one of them, you'll be able to run every program you like, simply giving to the method the
right argument.
In this PoC, I use the "StartProcess()" method t
Exploit-DB
W1L3D4 philboard 0.2 - 'W1L3D4_bolum.asp' SQL Injection
exploitdb·2007-05-11
CVE-2007-2641 W1L3D4 philboard 0.2 - 'W1L3D4_bolum.asp' SQL Injection
W1L3D4 philboard 0.2 - 'W1L3D4_bolum.asp' SQL Injection
---
Discovered by: gsy & kerem125
Website: www.kerem125.com
script download:http://www.aspindir.com/indir2.asp?id=4891&sIslem=%DDndir
exploit:/W1L3D4_bolum.asp?forumid=-99+union+all+select+0,1,2,3,4,5,6,7,8,9,password,username,12,13,14,15,16,17,18,19,20+from+users
example:http://philboard.somee.com/W1L3D4_bolum.asp?forumid=-99+union+all+select+0,1,2,3,4,5,6,7,8,9,password,username,12,13,14,15,16,17,18,19,20+from+users
contact: [email protected] & [email protected]
Special thx to:by_emr3 , ercu_145, bolivar, voltigore, mardinli, f10
# milw0rm.com [2007-05-11]
No writeups or analysis indexed.
http://osvdb.org/37106http://secunia.com/advisories/26779http://shinnai.altervista.org/exploits/txt/TXT_AZJ5bXwXvMARqwtfe97I.htmlhttp://www.securityfocus.com/bid/25638https://exchange.xforce.ibmcloud.com/vulnerabilities/36572https://www.exploit-db.com/exploits/4393http://osvdb.org/37106http://secunia.com/advisories/26779http://shinnai.altervista.org/exploits/txt/TXT_AZJ5bXwXvMARqwtfe97I.htmlhttp://www.securityfocus.com/bid/25638https://exchange.xforce.ibmcloud.com/vulnerabilities/36572https://www.exploit-db.com/exploits/4393
2007-09-14
Published