CVE-2013-6127
WellinTech KingView < 6.53 - Arbitrary File Write via SUPERGRIDLib.SuperGrid ReplaceDBFile Method
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2013-6127. PoCs published by blake.
AI-analyzed exploit summary This exploit leverages an insecure ActiveX control (SuperGrid.ocx) in KingView 6.53 to copy arbitrary files from a source to a destination via the ReplaceDBFile method. It demonstrates file manipulation capabilities, potentially allowing an attacker to overwrite or exfiltrate files.
Description
The SUPERGRIDLib.SuperGrid ActiveX control in SuperGrid.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53 does not properly restrict ReplaceDBFile method calls, which allows remote attackers to create or overwrite arbitrary files, and subsequently execute arbitrary programs, via the two pathname arguments, as demonstrated by a directory traversal attack.
Exploits (1)
This exploit leverages an insecure ActiveX control (SuperGrid.ocx) in KingView 6.53 to copy arbitrary files from a source to a destination via the ReplaceDBFile method. It demonstrates file manipulation capabilities, potentially allowing an attacker to overwrite or exfiltrate files.