PT-2007-6790 · Edraw · Edraw Flowchart Activex Control

Shinnai · Published 2007-11-05 · Updated 2017-09-29 · CVE-2007-5826

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EDraw Flowchart ActiveX control in EDImage.ocx version 2.0.2005.1104

Description The issue allows remote attackers to create or overwrite arbitrary files with arbitrary contents via a full pathname in the second argument to the HttpDownloadFile method.

Recommendations For EDImage.ocx version 2.0.2005.1104, consider restricting access to the HttpDownloadFile method to minimize the risk of exploitation. As a temporary workaround, avoid using the HttpDownloadFile method with untrusted input until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2007-5826

Affected Products

Edraw Flowchart Activex Control

References · 8

• 🔥 https://exploit-db.com/exploits/4598 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-5826 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38223 · Note
• http://securityfocus.com/bid/26308 · Note
• http://osvdb.org/38415 · Note
• http://vupen.com/english/advisories/2007/3710 · Note
• http://shinnai.altervista.org/exploits/txt/TXT_3kXDua0a0Tl5Vm5LU3ms.html · Note
• http://secunia.com/advisories/27462 · Note