Description
Multiple unspecified vulnerabilities in the Intuit QuickBooks Online Edition ActiveX control before 10 allow remote attackers to create or overwrite arbitrary files via unspecified arguments to the (1) httpGETToFile, (2) httpPOSTFromFile, and possibly other methods, probably involving path traversal vulnerabilities in exposed dangerous methods. NOTE: this can be leveraged for code execution by writing to a Startup folder.
References (5)
Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/36464
Patch, Third Party Advisory, US Government Resource third-party-advisory
x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/979638
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/26659
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/37134
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/25544
Scores
EPSS
0.0515
EPSS Percentile
91.4%
Details
CWE
CWE-22
CWE-264
Status
published
Products (1)
intuit/quickbooks
Published
Sep 05, 2007
Tracked Since
Feb 18, 2026