CVE-2010-2590

SAP Crystal Reports 2008 SP3 Fix Pack 3.2 - Remote Code Execution via Long ServerResourceVersion Property

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2010-2590. PoCs published by Metasploit, Dr_IDE, Dmitriy Pletnev, Dr_IDE, juan vazquez, including Metasploit module exploits/windows/browser/crystal_reports_printcontrol.

AI-analyzed exploit summary This Metasploit module exploits a heap-based buffer overflow in Crystal Reports' CrystalPrintControl ActiveX via the ServerResourceVersion property, achieving remote code execution on vulnerable systems. It uses ROP techniques to bypass DEP/ASLR and targets IE 6-8 on Windows XP/7.

Description

Heap-based buffer overflow in the CrystalReports12.CrystalPrintControl.1 ActiveX control in PrintControl.dll 12.3.2.753 in SAP Crystal Reports 2008 SP3 Fix Pack 3.2 allows remote attackers to execute arbitrary code via a long ServerResourceVersion property value.

Exploits (3)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/23472

This Metasploit module exploits a heap-based buffer overflow in Crystal Reports' CrystalPrintControl ActiveX via the ServerResourceVersion property, achieving remote code execution on vulnerable systems. It uses ROP techniques to bypass DEP/ASLR and targets IE 6-8 on Windows XP/7.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Crystal Reports 2008 / PrintControl.dll 12.0.0.683
No auth needed
Prerequisites: Victim must visit a malicious webpage using Internet Explorer 6-8 · Crystal Reports 2008 with vulnerable PrintControl.dll must be installed
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Dr_IDE · htmlremotewindows
https://www.exploit-db.com/exploits/15733

This exploit targets a buffer overflow vulnerability in Crystal Reports Viewer 12.0.0.549 ActiveX control (PrintControl.dll) via the ServerResourceVersion method. It uses a heap spray technique to achieve remote code execution, specifically launching calc.exe as a payload.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Racy
Target: Crystal Reports Viewer 12.0.0.549 (PrintControl.dll)
No auth needed
Prerequisites: Victim must visit a malicious webpage using Internet Explorer · Crystal Reports Viewer 12.0.0.549 ActiveX control must be installed
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC NORMAL
by Dmitriy Pletnev, Dr_IDE, juan vazquez · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/crystal_reports_printcontrol.rb

This Metasploit module exploits a heap-based buffer overflow in Crystal Reports' CrystalPrintControl ActiveX via the ServerResourceVersion property. It uses ROP chains and heap spraying to achieve remote code execution on vulnerable systems.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Crystal Reports 2008 / PrintControl.dll 12.0.0.683
No auth needed
Prerequisites: Vulnerable Crystal Reports ActiveX control installed · Target using IE 6-8 on Windows XP SP3 or IE 8 on Windows 7 SP1
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (9)

Core 9
Core References
Various Sources x_refsource_misc
https://service.sap.com/sap/support/notes/1539269
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/15733
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/45387
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/515369/100/0/threaded
Vendor Advisory x_refsource_misc
http://secunia.com/secunia_research/2010-135/
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/42305
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/69917
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1024915

Scores

EPSS 0.4678
EPSS Percentile 98.7%

Details

CWE
CWE-119
Status published
Products (1)
sap/crystal_reports 2008 sp3_fp3.2
Published Dec 22, 2010
Tracked Since Feb 18, 2026