CVE-2012-2174
IBM Lotus Notes 8.x - Remote Code Execution via Crafted notes:// URL
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2012-2174.
PoCs published by Metasploit, Moritz Jodeit, Sean de Regge, juan vazquez, including Metasploit module exploits/windows/browser/notes_handler_cmdinject.
AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in IBM Lotus Notes Client via a crafted notes:// URL, leading to arbitrary command execution. It delivers a payload through an HTTP server and uses JavaScript to trigger the exploit.
Description
The URL handler in IBM Lotus Notes 8.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a crafted notes:// URL.
Exploits (2)
This Metasploit module exploits a command injection vulnerability in IBM Lotus Notes Client via a crafted notes:// URL, leading to arbitrary command execution. It delivers a payload through an HTTP server and uses JavaScript to trigger the exploit.
This Metasploit module exploits a command injection vulnerability in IBM Lotus Notes Client via a crafted notes:// URL, allowing arbitrary command execution. It delivers a payload through a malicious HTML page that triggers the vulnerability when rendered.