This is a detailed technical analysis of multiple insecure methods in UCanCode ActiveX controls that allow arbitrary file overwrite. The writeup lists vulnerable ProgIDs, CLSIDs, and methods like ExportAsBitmapFile and SaveMemory2.
Classification
Writeup 90%
Target:
UCanCode ActiveX controls (multiple versions)
No auth needed
Prerequisites:
Victim must have UCanCode ActiveX controls installed · Attacker must deliver a malicious HTML/JS file to trigger the ActiveX methods