CVE-2008-2683
Black Ice Barcode SDK - Arbitrary File Write via BIDIB.BIDIBCtrl.1 DownloadImageFileURL Method
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2008-2683.
PoCs published by Metasploit, mr_me, shinnai, including Metasploit module exploits/windows/browser/blackice_downloadimagefileurl.
AI-analyzed exploit summary This Metasploit module exploits a vulnerability in the Black Ice BIImgFrm.ocx ActiveX control (version 12.0.0.0) to achieve arbitrary file download and remote code execution via the DownloadImageFileURL method. It leverages WMI (Windows Management Instrumentation) to execute a payload on Windows systems prior to Vista.
Description
The BIDIB.BIDIBCtrl.1 ActiveX control in BIDIB.ocx 10.9.3.0 in Black Ice Barcode SDK 5.01 allows remote attackers to force the download and storage of arbitrary files by specifying the origin URL in the first argument to the DownloadImageFileURL method, and the local filename in the second argument. NOTE: some of these details are obtained from third party information.
Exploits (4)
This Metasploit module exploits a vulnerability in the Black Ice BIImgFrm.ocx ActiveX control (version 12.0.0.0) to achieve arbitrary file download and remote code execution via the DownloadImageFileURL method. It leverages WMI (Windows Management Instrumentation) to execute a payload on Windows systems prior to Vista.
This exploit leverages an insecure method in the Black Ice Cover Page ActiveX control to download arbitrary files to a target system. The Metasploit module automates the attack by serving a malicious HTML page that triggers the vulnerability.
This exploit demonstrates two vulnerabilities in Black Ice Software's Barcode SDK (BIDIB.ocx): arbitrary file download and memory corruption via the DownloadImageFileURL method. The PoC uses VBScript to trigger these issues in Internet Explorer.
This Metasploit module exploits CVE-2008-2683 by abusing the 'DownloadImageFileURL' method in the Black Ice BIImgFrm.ocx ActiveX control to download arbitrary files. It achieves remote code execution by uploading a payload and a MOF file, leveraging Windows Management Instrumentation (WMI) to execute the payload.