CVE-2008-4385
System Requirements Lab 3 - Remote Code Execution via Malicious Website Argument to Init Method
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2008-4385.
PoCs published by Metasploit, MC, including Metasploit module exploits/windows/browser/systemrequirementslab_unsafe.
AI-analyzed exploit summary This Metasploit module exploits an unsafe method in the Husdawg, LLC. System Requirements Lab ActiveX Control (sysreqlab2.dll 2.30.0.0) to achieve remote code execution via a malicious HTML page.
Description
Husdawg, LLC Systems Requirements Lab 3, as used by Instant Expert Analysis, allows remote attackers to force the download and execution of arbitrary programs via by specifiying a malicious website argument to the Init method in (1) a certain ActiveX control (sysreqlab2.cab, sysreqlab.dll, sysreqlabsli.dll, or sysreqlab2.dll) and (2) a certain Java applet in RLApplet.class in sysreqlab2.jar or sysreqlab.jar.
Exploits (2)
This Metasploit module exploits an unsafe method in the Husdawg, LLC. System Requirements Lab ActiveX Control (sysreqlab2.dll 2.30.0.0) to achieve remote code execution via a malicious HTML page.
This Metasploit module exploits an unsafe method in the Husdawg, LLC. System Requirements Lab ActiveX Control (sysreqlab2.dll 2.30.0.0) to achieve remote code execution. It serves a malicious HTML page that triggers the vulnerability, leading to the download and execution of a payload EXE.