CVE-2011-10030

This exploit leverages an unsafe JavaScript API in Foxit PDF Reader 4.2 to write arbitrary files to the filesystem, achieving remote code execution by dropping a payload in the Startup folder. It uses base64-encoded payloads and a VBS decoder to execute the final executable.

This Metasploit module exploits an unsafe JavaScript API in Foxit PDF Reader 4.2, allowing arbitrary file writes via the createDataObject() function. It writes a base64-encoded payload and a decoder script to the Windows Temp directory, achieving remote code execution when an administrative user opens the malicious PDF.