Exploitation Summary
EIP tracks 2 public exploits for CVE-2024-42845. PoCs published by partywavesec, theexploiters.
AI-analyzed exploit summary The repository contains a functional exploit for CVE-2024-42845, which leverages an unsafe `eval()` call in Invesalius3's DICOM file parsing to achieve remote code execution. The exploit crafts a malicious DICOM file with embedded Python payloads executed via the vulnerable `GetImagePosition` function.
Description
An eval Injection vulnerability in the component invesalius/reader/dicom.py of InVesalius 3.1.99991 through 3.1.99998 allows attackers to execute arbitrary code via loading a crafted DICOM file.
Exploits (2)
The repository contains a functional exploit for CVE-2024-42845, which leverages an unsafe `eval()` call in Invesalius3's DICOM file parsing to achieve remote code execution. The exploit crafts a malicious DICOM file with embedded Python payloads executed via the vulnerable `GetImagePosition` function.
The repository contains a functional Python script that crafts a malicious DICOM file to exploit CVE-2024-42845, a Remote Code Execution (RCE) vulnerability in Invesalius 3.1. The exploit manipulates DICOM metadata to inject and execute arbitrary Python code upon file import.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H