Exploitation Summary
EIP tracks 3 public exploits for CVE-2011-10015.
PoCs published by Metasploit, Luigi Auriemma, including Metasploit module exploits/windows/fileformat/cytel_studio_cy3.
AI-analyzed exploit summary This is a Metasploit module exploiting a stack-based buffer overflow in Cytel Studio 9.0 via a malformed CY3 file. It leverages SEH overwrite to achieve remote code execution.
Description
Cytel Studio version 9.0 and earlier is vulnerable to a stack-based buffer overflow triggered by parsing a malformed .CY3 file. The vulnerability occurs when the application copies user-controlled strings into a fixed-size stack buffer (256 bytes) without proper bounds checking. Exploitation allows arbitrary code execution when the crafted file is opened.
Exploits (3)
This is a Metasploit module exploiting a stack-based buffer overflow in Cytel Studio 9.0 via a malformed CY3 file. It leverages SEH overwrite to achieve remote code execution.
This is a vulnerability writeup detailing three stack overflow vulnerabilities in Cytel Studio products (StatXact, LogXact, CrossOver) versions <= 9.0.0. The vulnerabilities include a strings stack overflow, a rows integer overflow, and a CYB USE stack overflow, all exploitable via file input.
This Metasploit module exploits a stack-based buffer overflow in Cytel Studio 9.0 via a malformed CY3 file, triggering an SEH overwrite to achieve remote code execution.
References (8)
Scores
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H