critical9.3Public exploit code
CVE-2009-2261
PeaZIP 2.6.1, 2.5.1, and earlier on Windows allows user-assisted remote attackers to execute arbitrary commands via a .zip archive with a .txt file whose name …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- PeaZIP 2.6.1 - Zip Processing Command Injection (Metasploit)2010-09-20 · local · multiple · Verified
- PeaZIP 2.6.1 - Compressed Filename Command Injection2009-06-05 · local · windows · Verified
Impact
PeaZIP 2.6.1, 2.5.1, and earlier on Windows allows user-assisted remote attackers to execute arbitrary commands via a .zip archive with a .txt file whose name contains | (pipe) characters and a command.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Giorgio Tani | Peazip | through 2.5.1 Versions 1.0, 1.1, 1.2, 1.3, 1.4 |