Exploitation Summary
EIP tracks 4 public exploits for CVE-2007-4607.
PoCs published by Metasploit, rgod, joeyrideout, including Metasploit module exploits/windows/browser/oracle_dc_submittoexpress.
AI-analyzed exploit summary This exploit targets a stack buffer overflow in Oracle Document Capture 10g via an ActiveX control (emsmtp.dll). It uses a heap spray technique to execute arbitrary shellcode when a long string is passed to the 'SubmitToExpress' method.
Description
Buffer overflow in the EasyMailSMTPObj ActiveX control in emsmtp.dll 6.0.1 in the Quiksoft EasyMail SMTP Object, as used in Postcast Server Pro 3.0.61 and other products, allows remote attackers to execute arbitrary code via a long argument to the SubmitToExpress method, a different vulnerability than CVE-2007-1029. NOTE: this may have been fixed in version 6.0.3.15.
Exploits (4)
This exploit targets a stack buffer overflow in Oracle Document Capture 10g via an ActiveX control (emsmtp.dll). It uses a heap spray technique to execute arbitrary shellcode when a long string is passed to the 'SubmitToExpress' method.
This exploit targets a buffer overflow in Quiksoft EasyMail SMTP Object (emsmtp.dll 6.0.1) via the SubmitToExpress method. It leverages SEH overwrite and a JMP ESP technique to execute shellcode that launches calc.exe.
This repository contains a Python 2.7.15 32-bit PoC for CVE-2007-4607, targeting a buffer overflow vulnerability in EasyMail SMTP's SubmitToExpress method. The exploit attempts to trigger the vulnerability by passing an excessively long string (>99999 chars) to the method.
This Metasploit module exploits a stack buffer overflow in Oracle Document Capture 10g's ActiveX control (emsmtp.dll) via the 'SubmitToExpress' method. It uses heap spraying and JavaScript obfuscation to deliver a payload, achieving remote code execution on vulnerable Windows systems.