Exploitation Summary
EIP tracks 3 public exploits for CVE-2013-6040. PoCs published by Pedro Ribeiro.
AI-analyzed exploit summary This exploit demonstrates a buffer overflow vulnerability in the MW6MaxiCode ActiveX control (CLSID {2355C601-37D1-42B4-BEB1-03C773298DC8}) by passing an overly long string to the 'Data' parameter, leading to arbitrary code execution. The PoC triggers a crash in Internet Explorer, with registers EAX and ECX controllable via crafted input.
Description
MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls before version 4.0 vulnerable to arbitrary code via a crafted HTML document. Latest versions (4.0) of MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls have resolved the issue
Exploits (3)
This exploit demonstrates a buffer overflow vulnerability in the MW6MaxiCode ActiveX control (CLSID {2355C601-37D1-42B4-BEB1-03C773298DC8}) by passing an overly long string to the 'Data' parameter, leading to arbitrary code execution. The PoC triggers a crash in Internet Explorer, with registers EAX and ECX controllable via crafted input.
This is a proof-of-concept exploit for a buffer overflow vulnerability in the MW6DataMatrix ActiveX control (CVE-2013-6040). The exploit triggers a write access violation by passing an overly long string to the 'Data' parameter, potentially leading to arbitrary code execution.
This exploit demonstrates a buffer overflow vulnerability in the MW6Aztec ActiveX control (CLSID: {F359732D-D020-40ED-83FF-F381EFE36B54}) by passing a string larger than 9000 characters to the 'Data' parameter, leading to arbitrary code execution.
References (4)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H