CVE-2011-10030

HIGH

Foxit PDF Reader < 4.3.1.0218 - Code Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2011-10030. PoCs published by Metasploit, bannedit, Chris Evans, including Metasploit module exploits/windows/fileformat/foxit_reader_filewrite.

AI-analyzed exploit summary This exploit leverages an unsafe JavaScript API in Foxit PDF Reader 4.2 to write arbitrary files to the filesystem, achieving remote code execution by dropping a payload in the Startup folder. It uses base64-encoded payloads and a VBS decoder to execute the final executable.

Description

Foxit PDF Reader <  4.3.1.0218 exposes a JavaScript API function, createDataObject(), that allows untrusted PDF content to write arbitrary files anywhere on disk. By embedding a malicious PDF that calls this API, an attacker can drop executables or scripts into privileged folders, leading to code execution the next time the system boots or the user logs in.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubylocalwindows
https://www.exploit-db.com/exploits/16978

This exploit leverages an unsafe JavaScript API in Foxit PDF Reader 4.2 to write arbitrary files to the filesystem, achieving remote code execution by dropping a payload in the Startup folder. It uses base64-encoded payloads and a VBS decoder to execute the final executable.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Foxit PDF Reader 4.2
No auth needed
Prerequisites: Victim must open the malicious PDF file · Administrative privileges required for writing to the All Users Startup folder
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC NORMAL
by bannedit, Chris Evans · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/foxit_reader_filewrite.rb

This Metasploit module exploits an unsafe JavaScript API in Foxit PDF Reader 4.2, allowing arbitrary file writes via the createDataObject() function. It writes a base64-encoded payload and a decoder script to the Windows Temp directory, achieving remote code execution when an administrative user opens the malicious PDF.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Foxit PDF Reader v4.2
No auth needed
Prerequisites: Administrative privileges to write to the All Users directory · Victim must open the malicious PDF file
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Scores

CVSS v4 8.4
EPSS 0.0035
EPSS Percentile 26.9%
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-73
Status published
Products (1)
Foxit Software/Foxit PDF Reader < 4.3.1.0218
Published Aug 20, 2025
Tracked Since Feb 18, 2026