PT-2007-6790 · Edraw · Edraw Flowchart Activex Control

Shinnai · Publicado 2007-11-05 · Atualizado 2017-09-29 · CVE-2007-5826

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EDraw Flowchart ActiveX control in EDImage.ocx version 2.0.2005.1104

Description The issue allows remote attackers to create or overwrite arbitrary files with arbitrary contents via a full pathname in the second argument to the HttpDownloadFile method.

Recommendations For EDImage.ocx version 2.0.2005.1104, consider restricting access to the HttpDownloadFile method to minimize the risk of exploitation. As a temporary workaround, avoid using the HttpDownloadFile method with untrusted input until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2007-5826

Produtos afetados

Edraw Flowchart Activex Control

Referências · 8

• 🔥 https://exploit-db.com/exploits/4598 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38223 · Nota
• http://securityfocus.com/bid/26308 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5826 · Nota de Segurança
• http://osvdb.org/38415 · Nota
• http://vupen.com/english/advisories/2007/3710 · Nota
• http://shinnai.altervista.org/exploits/txt/TXT_3kXDua0a0Tl5Vm5LU3ms.html · Nota
• http://secunia.com/advisories/27462 · Nota