medium5.8Public exploit code
CVE-2009-1064
Argument injection vulnerability in orbitmxt.dll 2.1.0.2 in the Orbit Downloader 2.8.7 and earlier ActiveX control allows remote attackers to overwrite arbitra…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Orbit Downloader 2.8.7 - Arbitrary File Deletion2009-03-23 · remote · windows · Verified
Impact
Argument injection vulnerability in orbitmxt.dll 2.1.0.2 in the Orbit Downloader 2.8.7 and earlier ActiveX control allows remote attackers to overwrite arbitrary files via whitespace and a command-line switch, followed by a full pathname, in the third argument to the download method.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Orbit Downloader | Orbit Downloader | Versions 2.6.3, 2.6.4 |
| Orbitdownloader | Orbit Downloader | through 2.8.7 Versions 2.6.1, 2.6.3, 2.6.4, 2.6.5, 2.7.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/34200
- http://www.waraxe.us/advisory-73.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49353
- https://www.exploit-db.com/exploits/8257
- http://www.securityfocus.com/bid/34200
- http://www.waraxe.us/advisory-73.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49353
- https://www.exploit-db.com/exploits/8257