File Manipulation Vulnerability in Progress Webspeed Messenger

CVE-2007-2266

Summary

Progress Webspeed Messenger suffers from a vulnerability that enables remote attackers to interact with the system by reading, creating, modifying, and executing arbitrary files. This can be exploited through the webutil/_cpyfile.p component by manipulating the WService parameter in scripts such as cgiip.exe or wsisa.dll. Attackers can leverage options like save and editor to craft new files by using the fileName parameter, potentially compromising the integrity and confidentiality of the system.

References