Description (CNA)
Hubstaff 1.6.14 contains a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious library. Attackers can generate a custom DLL using Metasploit and place it in the system32 directory to obtain a reverse shell during application startup.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Hubstaff / Hubstaff | affected 1.6.13, 1.6.14 |
CWE
CWE-427
References
- https://www.exploit-db.com/exploits/51461
- https://hubstaff.com/
- https://www.vulncheck.com/advisories/hubstaff-dll-search-order-hijacking-via-wowlog-library
ADP enrichment
No English description supplied.
No references supplied.