CVE-2009-2011

This Metasploit module exploits a command execution vulnerability in DX Studio Player by crafting a malicious .dxstudio file that writes a batch file to disk and executes it via the ActiveX control. The exploit leverages the plugin's unsafe handling of script execution to achieve RCE.

The exploit demonstrates a command injection vulnerability in the DX Studio Player Firefox plug-in, allowing arbitrary command execution via the `shell.execute()` method without user warnings in Firefox. The PoC includes an XML file that triggers the execution of `cmd.exe` with a test command.

This exploit leverages a command execution vulnerability in Worldweaver DX Studio Player by crafting a malicious .dxstudio file that writes a batch script to disk and executes it via shell.execute(). It targets the ActiveX and Firefox plugin versions of the player.