CVE-2009-3693

Directory traversal vulnerability in the Persits.XUpload.2 ActiveX control (XUpload.ocx) in HP LoadRunner 9.5 allows remote attackers to create arbitrary files via \.. (backwards slash dot dot) sequences in the third argument to the MakeHttpRequest method.

CVSS v2.0

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

41.58% chance of exploitation in the next 30 days, 99th percentile

Published

2009-10-13

Updated

2024-09-16

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/persits_xupload_…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/16598
• https://www.exploit-db.com/exploits/9806

References

• CVE Record
• NVD entry

Related

• CVE-2009-3692
• CVE-2009-3694
• CVE-2009-3691
• CVE-2009-3699
• CVE-2009-3678
• CVE-2009-3701