CVE-2019-6453

mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers. The attacker can specify an irc:// URI that loads an arbitrary .ini file from a UNC share pathname. Exploitation depends on browser-specific URI handling (Chrome is not exploitable).

CVSS v3.0

8.1 HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

54.29% chance of exploitation in the next 30 days, 99th percentile

Published

2019-02-18

Updated

2024-08-04

Proof-of-concept exploits (3)

• proofofcalc/cve-2019-6453-poc48★ · 2024-01-01
• https://proofofcalc.com/cve-2019-6453-mIRC/
• andripwn/mIRC-CVE-2019-64531★ · 2020-09-20

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/46392

References

• CVE Record
• NVD entry

Related

• CVE-2018-18852
• CVE-2019-0708
• CVE-2019-11510
• CVE-2019-16759
• CVE-2019-19781
• CVE-2019-19844