CVE-2008-1898
EXPLOITEDMicrosoft Office and Works - Remote Code Execution via WkImgSrv.dll WksPictureInterface Property
Title source: llmExploitation Summary
CVE-2008-1898 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 4 public exploits from researchers including Metasploit, lhoang8500, Shennan Wang, including a Metasploit module exploits/windows/fileformat/msworks_wkspictureinterface.
AI-analyzed exploit summary This exploit targets a vulnerability in Microsoft Works 7 WkImgSrv.dll ActiveX control by passing a negative integer to the WksPictureInterface method, leading to arbitrary code execution. It generates an HTML file with embedded JavaScript to trigger the exploit.
Description
A certain ActiveX control in WkImgSrv.dll 7.03.0616.0, as distributed in Microsoft Works 7 and Microsoft Office 2003 and 2007, allows remote attackers to execute arbitrary code or cause a denial of service (browser crash) via an invalid WksPictureInterface property value, which triggers an improper function call.
Exploits (4)
This exploit targets a vulnerability in Microsoft Works 7 WkImgSrv.dll ActiveX control by passing a negative integer to the WksPictureInterface method, leading to arbitrary code execution. It generates an HTML file with embedded JavaScript to trigger the exploit.
This exploit targets a memory corruption vulnerability in WKsPictureInterface method of wkimgsrv.dll, leveraging heap spraying to execute arbitrary shellcode. It uses a carefully crafted memory layout to bypass NULL checks and redirect execution flow.
This exploit targets a vulnerability in Microsoft Works 7 by manipulating the WksPictureInterface property of an ActiveX object, leading to a crash (DoS). The PoC uses JavaScript to trigger the vulnerability via an HTML page.
This Metasploit module exploits a vulnerability in Microsoft Works 7 WkImgSrv.dll ActiveX control by passing a negative integer to the WKsPictureInterface method, leading to arbitrary code execution. The exploit generates an HTML file with obfuscated JavaScript to trigger the vulnerability and execute shellcode.