CVE-2010-2561
Microsoft XML Core Services 3.0 - Remote Code Execution via Crafted HTTP Response
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2010-2561. PoCs published by Skylined.
AI-analyzed exploit summary This exploit leverages CVE-2010-2561, a memory corruption vulnerability in the Msxml2.XMLHTTP ActiveX control, by repeatedly sending malformed HTTP responses to trigger a denial-of-service (DoS) or potential remote code execution (RCE). The script sets up a web server that serves a malicious HTML page with JavaScript to exploit the vulnerability.
Description
Microsoft XML Core Services (aka MSXML) 3.0 does not properly handle HTTP responses, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted response, aka "Msxml2.XMLHTTP.3.0 Response Handling Memory Corruption Vulnerability."
Exploits (1)
This exploit leverages CVE-2010-2561, a memory corruption vulnerability in the Msxml2.XMLHTTP ActiveX control, by repeatedly sending malformed HTTP responses to trigger a denial-of-service (DoS) or potential remote code execution (RCE). The script sets up a web server that serves a malicious HTML page with JavaScript to exploit the vulnerability.