DSUtility.dll in Pelco Digital Sentry Server before 7.19.67 has an arbitrary file write vulnerability. The AppendToTextFile method doesnt check if its being called from the application or from a malicious user. The vulnerability is triggered when a remote attacker crafts an HTML page (e.g., with OBJECT classid= and ) to overwrite arbitrary files.
The product does not properly verify that the source of data or communication is valid.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Digital_sentry_server | Pelco | * | 7.19.67 (excluding) |