high8.1Public exploit code
CVE-2019-6453
mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- mIRC < 7.55 - 'Custom URI Protocol Handlers' Remote Command Execution2019-02-18 · remote · windows
Impact
mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers. The attacker can specify an irc:// URI that loads an arbitrary .ini file from a UNC share pathname. Exploitation depends on browser-specific URI handling (Chrome is not exploitable).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mirc | Mirc | before 7.55 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/proofofcalc/cve-2019-6453-poc
- https://proofofcalc.com/advisories/20190218.txt
- https://proofofcalc.com/cve-2019-6453-mIRC/
- https://twitter.com/proofofcalc/status/1097518413143003136
- https://www.exploit-db.com/exploits/46392/
- https://www.mirc.com/news.html
- https://github.com/proofofcalc/cve-2019-6453-poc
- https://proofofcalc.com/advisories/20190218.txt
- https://proofofcalc.com/cve-2019-6453-mIRC/
- https://twitter.com/proofofcalc/status/1097518413143003136
- https://www.exploit-db.com/exploits/46392/
- https://www.mirc.com/news.html