CVE-2008-4493

CVE Database · CVE-2008-4493

CVE-2008-4493

· N/AModified

CVSS v3.1

N/A

EPSS

17.59%

Published

Oct 8, 2008

Modified

Apr 22, 2026

Public PoC / Exploit (2)

All weaponized →

Exploit-DBMicrosoft PicturePusher - ActiveX Cross-Site Arbitrary File Upload TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Microsoft PicturePusher ActiveX control (PipPPush.DLL 7.00.0709), as used in Microsoft Digital Image 2006 Starter Edition, allows remote attackers to force the upload of arbitrary files by using the AddString and Post methods and a modified PostURL to construct an HTTP POST request. NOTE: this issue might only be exploitable in limited environments or non-default browser settings.

Weaknesses (CWE)

CWE-20

Affected Products (1)

microsoft · digital_imagevulnerable

References (10)

http://securityreason.com/securityalert/4376

http://www.securityfocus.com/bid/31632

Exploit

http://www.securitytracker.com/id?1021018

https://exchange.xforce.ibmcloud.com/vulnerabilities/45735

https://www.exploit-db.com/exploits/6699