Vulnerabilities > CVE-2007-3605 - Stack Buffer Overflow vulnerability in SAP EnjoySAP KWEdit.DLL ActiveX Control

047910
CVSS 7.6 - HIGH
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
high complexity
sap
exploit available
metasploit
NVD
Published: 2007-07-06
Updated: 2018-10-15

Summary

Stack-based buffer overflow in the kweditcontrol.kwedit.1 ActiveX control in FrontEnd\SapGui\kwedit.dll in the EnjoySAP SAP GUI allows remote attackers to execute arbitrary code via a long argument to the PrepareToPostHTML function.

Vulnerable Configurations

Part Description Count
Application
Sap
1

Exploit-Db

  • descriptionEnjoySAP SAP GUI ActiveX Control Buffer Overflow. CVE-2007-3605. Remote exploit for windows platform
    idEDB-ID:16498
    last seen2016-02-02
    modified2010-06-15
    published2010-06-15
    reportermetasploit
    sourcehttps://www.exploit-db.com/download/16498/
    titleEnjoySAP SAP GUI ActiveX Control Buffer Overflow
  • descriptionEnjoySAP ActiveX kweditcontrol.kwedit.1 Remote Stack Overflow PoC. CVE-2007-3605,CVE-2007-3607,CVE-2007-3608. Dos exploit for windows platform
    fileexploits/windows/dos/4148.html
    idEDB-ID:4148
    last seen2016-01-31
    modified2007-07-05
    platformwindows
    port
    published2007-07-05
    reporterMark Litchfield
    sourcehttps://www.exploit-db.com/download/4148/
    titleEnjoySAP ActiveX kweditcontrol.kwedit.1 - Remote Stack Overflow PoC
    typedos

Metasploit

descriptionThis module exploits a stack buffer overflow in SAP KWEdit ActiveX Control (kwedit.dll 6400.1.1.41) provided by EnjoySAP GUI. By sending an overly long string to the "PrepareToPostHTML()" method, an attacker may be able to execute arbitrary code.
idMSF:EXPLOIT/WINDOWS/BROWSER/ENJOYSAPGUI_PREPARETOPOSTHTML
last seen2020-06-14
modified2017-07-24
published2007-07-18
referenceshttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3605
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/browser/enjoysapgui_preparetoposthtml.rb
titleEnjoySAP SAP GUI ActiveX Control Buffer Overflow

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/83119/enjoysapgui_preparetoposthtml.rb.txt
idPACKETSTORM:83119
last seen2016-12-05
published2009-11-26
reporterMC
sourcehttps://packetstormsecurity.com/files/83119/EnjoySAP-SAP-GUI-ActiveX-Control-Buffer-Overflow.html
titleEnjoySAP SAP GUI ActiveX Control Buffer Overflow

References