CVE-2007-4471

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-09-05 · updated 2026-06-16
Weakness: CWE-22

Description

Multiple unspecified vulnerabilities in the Intuit QuickBooks Online Edition ActiveX control before 10 allow remote attackers to create or overwrite arbitrary files via unspecified arguments to the (1) httpGETToFile, (2) httpPOSTFromFile, and possibly other methods, probably involving path traversal vulnerabilities in exposed dangerous methods. NOTE: this can be leveraged for code execution by writing to a Startup folder.

Affected products

Intuit Quickbooks: all versions

References

http://osvdb.org/37134
http://secunia.com/advisories/26659
http://www.kb.cert.org/vuls/id/979638
http://www.securityfocus.com/bid/25544
https://exchange.xforce.ibmcloud.com/vulnerabilities/36464
http://osvdb.org/37134
http://secunia.com/advisories/26659
http://www.kb.cert.org/vuls/id/979638
http://www.securityfocus.com/bid/25544
https://exchange.xforce.ibmcloud.com/vulnerabilities/36464

Get alerted when CVE-2007-4471 or the next vulnerability affects your stack