PT-2008-3266 · Ibiz · Ibiz E-Banking Integrator

Shinnai · Published 2008-04-11 · Updated 2017-09-29 · CVE-2008-1725

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:M/Au:N/C:P/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBiz E-Banking Integrator versions 2.0.2932

Description The issue concerns the IBizEBank.FIProfile.1 ActiveX control in the fiprofile20.ocx file, which exposes an unsafe method. This method allows remote attackers to overwrite arbitrary files by providing a full pathname in the argument.

Recommendations For version 2.0.2932, consider disabling the WriteOFXDataFile method as a temporary workaround until a patch is available. Restrict access to the fiprofile20.ocx file to minimize the risk of exploitation. Avoid using the full pathname argument in the affected method until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2008-1725

Affected Products

Ibiz E-Banking Integrator

References · 6

• 🔥 https://exploit-db.com/exploits/5416 · Exploit
• 🔥 http://securityfocus.com/bid/28700 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-1725 · Security Note
• http://secunia.com/advisories/29758 · Vendor Advisory
• http://osvdb.org/44393 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41752 · Note