CVE-2010-3141
Microsoft PowerPoint 2010 - DLL Hijacking via Untrusted Search Path
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2010-3141. PoCs published by TheLeader.
AI-analyzed exploit summary This exploit leverages DLL hijacking in Microsoft PowerPoint 2010 by replacing the legitimate pptimpconv.dll with a malicious version. When a user opens a PowerPoint file with specific extensions, the malicious DLL executes arbitrary code (e.g., launching calc.exe).
Description
Untrusted search path vulnerability in Microsoft PowerPoint 2010 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse pptimpconv.dll that is located in the same folder as a .odp, .pot, .potm, .potx, .ppa, .pps, .ppsm, .ppsx, .ppt, .pptm, .pptx, .pwz, .sldm, or .sldx file.
Exploits (2)
This exploit leverages DLL hijacking in Microsoft PowerPoint 2010 by replacing the legitimate pptimpconv.dll with a malicious version. When a user opens a PowerPoint file with specific extensions, the malicious DLL executes arbitrary code (e.g., launching calc.exe).
This exploit demonstrates a DLL hijacking vulnerability in Microsoft Office PowerPoint 2007 by creating a malicious rpawinet.dll that executes arbitrary code (calc.exe) when loaded. The exploit targets the insecure DLL loading mechanism in PowerPoint 2007 SP2.