Vulnerabilities > CVE-2018-17408 - Out-of-bounds Write vulnerability in Zahiraccounting Zahir Enterprise Plus 6

047910
CVSS 6.8 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
zahiraccounting
CWE-787
exploit available
metasploit
NVD
Published: 2018-10-03
Updated: 2020-08-24

Summary

Stack-based buffer overflows in Zahir Accounting Enterprise Plus 6 through build 10b allow remote attackers to execute arbitrary code via a crafted CSV file that is accessed through the Import CSV File menu.

Vulnerable Configurations

Part Description Count
Application
Zahiraccounting
1

Common Weakness Enumeration (CWE)

Exploit-Db

  • descriptionZahir Enterprise Plus 6 - Stack Buffer Overflow (Metasploit). CVE-2018-17408. Local exploit for Windows platform. Tags: Metasploit Framework (MSF), Local
    fileexploits/windows/local/45560.rb
    idEDB-ID:45560
    last seen2018-10-08
    modified2018-10-08
    platformwindows
    port
    published2018-10-08
    reporterExploit-DB
    sourcehttps://www.exploit-db.com/download/45560/
    titleZahir Enterprise Plus 6 - Stack Buffer Overflow (Metasploit)
    typelocal
  • descriptionZahir Enterprise Plus 6 build 10b - Buffer Overflow (SEH). Local exploit for Windows_x86 platform. Tags: Local, Buffer Overflow
    fileexploits/windows_x86/local/45505.py
    idEDB-ID:45505
    last seen2018-10-07
    modified2018-10-01
    platformwindows_x86
    port
    published2018-10-01
    reporterExploit-DB
    sourcehttps://www.exploit-db.com/download/45505/
    titleZahir Enterprise Plus 6 build 10b - Buffer Overflow (SEH)
    typelocal

Metasploit

descriptionThis module exploits a stack buffer overflow in Zahir Enterprise Plus version 6 build 10b and below. The vulnerability is triggered when opening a CSV file containing CR/LF and overly long string characters via Import from other File. This results in overwriting a structured exception handler record.
idMSF:EXPLOIT/WINDOWS/FILEFORMAT/ZAHIR_ENTERPRISE_PLUS_CSV
last seen2020-06-13
modified2018-10-04
published2018-09-29
referenceshttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17408
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/fileformat/zahir_enterprise_plus_csv.rb
titleZahir Enterprise Plus 6 Stack Buffer Overflow

Packetstorm

References