{"uuid": "987f6237-d7e4-4412-85b7-ef5a8df13f76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2009-4850", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/awingsoft_winds3d_sceneurl.rb", "content": "{\"aliases\": [], \"arch\": \"\", \"author\": [\"jduck \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits an untrusted program execution vulnerability within the\\n          Winds3D Player from AwingSoft. The Winds3D Player is a browser plugin for\\n          IE (ActiveX), Opera (DLL) and Firefox (XPI). By setting the 'SceneURL'\\n          parameter to the URL to an executable, an attacker can execute arbitrary\\n          code.\\n\\n          Testing was conducted using plugin version 3.5.0.9 for Firefox 3.5 and\\n          IE 8 on Windows XP SP3.\", \"disclosure_date\": \"2009-11-14\", \"fullname\": \"exploit/windows/browser/awingsoft_winds3d_sceneurl\", \"is_install_path\": true, \"mod_time\": \"2026-03-11 21:31:08 +0000\", \"name\": \"AwingSoft Winds3D Player 3.5 SceneURL Download and Execute\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/browser/awingsoft_winds3d_sceneurl.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/browser/awingsoft_winds3d_sceneurl\", \"references\": [\"CVE-2009-4850\", \"OSVDB-60049\"], \"rport\": null, \"session_types\": false, \"targets\": [\"Automatic\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:00.155186Z"}