Exploitation Summary
EIP tracks 2 public exploits for CVE-2008-1647. PoCs published by shinnai.
AI-analyzed exploit summary This exploit leverages an arbitrary file overwrite vulnerability in ChilkatHttp ActiveX 2.3 by calling the SaveLastError method to write to a system file (system_.ini). The PoC is a simple HTML file with embedded VBScript.
Description
The ChilkatHttp.ChilkatHttp.1 and ChilkatHttp.ChilkatHttpRequest.1 ActiveX controls in ChilkatHttp.dll 2.4.0.0, 2.3.0.0, and earlier in ChilkatHttp ActiveX expose the unsafe SaveLastError method, which allows remote attackers to overwrite arbitrary files. NOTE: some of these details are obtained from third party information.
Exploits (2)
This exploit leverages an arbitrary file overwrite vulnerability in ChilkatHttp ActiveX 2.3 by calling the SaveLastError method to write to a system file (system_.ini). The PoC is a simple HTML file with embedded VBScript.
This exploit leverages an arbitrary file creation vulnerability in ChilkatSocket.DLL (CVE-2008-1647) by invoking the SaveLastError method via an ActiveX control to write arbitrary data to a specified file path (e.g., c:\boot_.ini). The exploit is triggered via a simple HTML button click, demonstrating a trivial attack vector.