CVE-2008-2551
EXPLOITEDIcona Instant Messenger 1.0.0.1 - Remote Code Execution via DownloaderActiveX Control
Title source: llmExploitation Summary
CVE-2008-2551 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 3 public exploits from researchers including Metasploit, Nine:Situations:Group, Unknown, juan vazquez, including a Metasploit module exploits/windows/browser/c6_messenger_downloaderactivex.
AI-analyzed exploit summary This Metasploit module exploits a vulnerability in Icona SpA C6 Messenger's DownloaderActiveX control to download and execute arbitrary files. It leverages an insecure ActiveX control to achieve remote code execution in the context of the logged-on user.
Description
The DownloaderActiveX Control (DownloaderActiveX.ocx) in Icona SpA C6 Messenger 1.0.0.1 allows remote attackers to force the download and execution of arbitrary files via a URL in the propDownloadUrl parameter with the propPostDownloadAction parameter set to "run."
Exploits (3)
This Metasploit module exploits a vulnerability in Icona SpA C6 Messenger's DownloaderActiveX control to download and execute arbitrary files. It leverages an insecure ActiveX control to achieve remote code execution in the context of the logged-on user.
This exploit leverages an unsafe ActiveX control in C6 Messenger to remotely download and execute arbitrary files. The vulnerability arises from improper validation of the 'propDownloadUrl' and 'propPostDownloadAction' parameters, allowing remote code execution.
This Metasploit module exploits a vulnerability in the Icona SpA C6 Messenger DownloaderActiveX control to download and execute arbitrary files. It leverages an insecure ActiveX control to achieve remote code execution by crafting a malicious HTML page that triggers the download and execution of a payload.