Description
Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers to read and delete arbitrary files via ".." sequences in the dynamicimag argument to crystalimagehandler.aspx.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Business Objects Crystal Reports 9/10 Web Form Viewer - Directory Traversal EDB-24077 · remote · May 3, 2004 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20040502 Crystal Reports Vulnerabilities mailing-list
- http://support.businessobjects.com/fix/hot/critical/bulletins/security_bulletin_june04.asp
- 11800 third-party-advisory
- 20040608 Vulnerability: Arbitrary File Access & DoS in Crystal Reports mailing-list
- crystalreports-file-deletion(16044) vdb-entry
- 6748 vdb-entry
- 10260 vdb-entry
- oval:org.mitre.oval:def:1157 vdb-entry signature
- MS04-017 vendor-advisory