CVE-2008-4493
Microsoft Digital Image 2006 Starter Edition - Arbitrary File Upload via PicturePusher ActiveX Control
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-4493. PoCs published by Nine:Situations:Group.
AI-analyzed exploit summary This exploit leverages an unsafe ActiveX control (PicturePusher) in Microsoft Digital Image 2006 to craft arbitrary multipart/form-data POST requests, enabling file upload attacks via the browser. The PoC demonstrates how to inject a filename and content into a POST request, bypassing typical security restrictions.
Description
Microsoft PicturePusher ActiveX control (PipPPush.DLL 7.00.0709), as used in Microsoft Digital Image 2006 Starter Edition, allows remote attackers to force the upload of arbitrary files by using the AddString and Post methods and a modified PostURL to construct an HTTP POST request. NOTE: this issue might only be exploitable in limited environments or non-default browser settings.
Exploits (1)
This exploit leverages an unsafe ActiveX control (PicturePusher) in Microsoft Digital Image 2006 to craft arbitrary multipart/form-data POST requests, enabling file upload attacks via the browser. The PoC demonstrates how to inject a filename and content into a POST request, bypassing typical security restrictions.