CVE-2009-0465

The SaveDoc method in the All_In_The_Box.AllBox ActiveX control in ALL_IN_THE_BOX.OCX in Synactis ALL In-The-Box ActiveX 3 allows remote attackers to create and overwrite arbitrary files via an argument ending in a '\0' character, which bypasses the intended .box filename extension, as demonstrated by a C:\boot.ini\0 argument.

CVSS v2.0

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

3.64% chance of exploitation in the next 30 days, 89th percentile

Published

2009-02-06

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/7928

References

• CVE Record
• NVD entry

Related

• CVE-2009-0464
• CVE-2009-0467
• CVE-2009-0463
• CVE-2009-0468
• CVE-2009-0462
• CVE-2009-0470