CVE-2011-3497
Measuresoft ScadaPro < 4.0.0 - Remote Code Execution via XF Function
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2011-3497.
PoCs published by Luigi Auriemma, including Metasploit module exploits/windows/scada/scadapro_cmdexe.
AI-analyzed exploit summary This exploit demonstrates multiple vulnerabilities in Measuresoft ScadaPro, including arbitrary command execution, directory traversal, and stack overflows. The provided PoC includes commands to read files, create files, delete files, and execute arbitrary commands via DLL function calls.
Description
service.exe in Measuresoft ScadaPro 4.0.0 and earlier allows remote attackers to execute arbitrary DLL functions via the XF function, possibly related to an insecure exposed method.
Exploits (2)
This exploit demonstrates multiple vulnerabilities in Measuresoft ScadaPro, including arbitrary command execution, directory traversal, and stack overflows. The provided PoC includes commands to read files, create files, delete files, and execute arbitrary commands via DLL function calls.
This Metasploit module exploits a directory traversal vulnerability in Measuresoft ScadaPro to execute arbitrary commands via the 'xf' command, leveraging msvcrt.dll's system() function to download and execute a payload.