CVE-2009-3693

This Metasploit module exploits a directory traversal vulnerability in Persits XUpload ActiveX control (version 3.0.0.3) to write arbitrary files to arbitrary locations on disk, achieving remote code execution by placing an executable in the All Users Startup Programs directory.

This exploit leverages the Persits.XUpload.2 ActiveX control in HP LoadRunner 9.5 to remotely create a file via the MakeHttpRequest method. It downloads a batch script from a remote server and places it in the Startup folder for execution.

This Metasploit module exploits a directory traversal vulnerability in Persits XUpload ActiveX control (version 3.0.0.3) by leveraging the MakeHttpRequest method to write arbitrary files to arbitrary locations, achieving remote code execution via the All Users Startup Programs directory.