Multiple unspecified vulnerabilities in the Intuit QuickBooks Online Edition ActiveX control prior to 10 allow remote malicious users to create or overwrite arbitrary files via unspecified arguments to the (1) httpGETToFile, (2) httpPOSTFromFile, and possibly other methods, probably involving path traversal vulnerabilities in exposed dangerous methods. NOTE: this can be leveraged for code execution by writing to a Startup folder.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
intuit quickbooks |
Vulmon