PT-2007-6094 · Mw6 Technologies · Mw6 Technologies Qrcode Activex

Shinnai · Published 2007-09-19 · Updated 2017-09-29 · CVE-2007-4982

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MW6 Technologies QRCode ActiveX versions 3.0.0.1 and earlier

Description The issue allows remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the (1) SaveAsBMP or (2) SaveAsWMF method of the MW6QRCode.QRCode.1 ActiveX control in MW6QRCode.dll.

Recommendations For versions 3.0.0.1 and earlier, consider disabling the SaveAsBMP and SaveAsWMF methods until a patch is available to prevent exploitation. Restrict access to the MW6QRCode.dll to minimize the risk of arbitrary file creation or overwrite. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2007-4982

Affected Products

Mw6 Technologies Qrcode Activex

References · 9

• 🔥 https://exploit-db.com/exploits/4420 · Exploit
• http://secunia.com/advisories/26836 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-4982 · Security Note
• http://securityfocus.com/bid/25702 · Note
• http://shinnai.altervista.org/exploits/OREurGhGgAtlCT8J2jSY.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36666 · Note
• http://osvdb.org/37914 · Note
• http://vupen.com/english/advisories/2007/3195 · Note
• http://osvdb.org/37915 · Note