PT-2008-5726 · Microsoft · Picturepusher Activex Control+1

Rgod · Published 2008-10-08 · Updated 2017-09-29 · CVE-2008-4493

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Microsoft Digital Image 2006 Starter Edition

Description: The issue allows remote attackers to force the upload of arbitrary files by using the AddString and Post methods and a modified PostURL to construct an HTTP POST request. This is achieved through the Microsoft PicturePusher ActiveX control (PipPPush.DLL 7.00.0709). It is noted that this issue might only be exploitable in limited environments or non-default browser settings.

Recommendations: For Microsoft Digital Image 2006 Starter Edition, consider disabling the use of the Microsoft PicturePusher ActiveX control until a patch is available. Restrict access to the AddString and Post methods to minimize the risk of exploitation. Avoid using the PostURL parameter in the affected control to construct HTTP POST requests until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-4493

Affected Products

Digital Image

Picturepusher Activex Control

References · 6

• 🔥 https://exploit-db.com/exploits/6699 · Exploit
• 🔥 http://securityfocus.com/bid/31632 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4493 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45735 · Note
• http://securityreason.com/securityalert/4376 · Note
• http://securitytracker.com/id?1021018 · Note