IndigoSTAR Software - perl2exe <= V30.10C - Arbitrary Code Execution | Advisories

Advisories

IndigoSTAR Software - perl2exe <= V30.10C - Arbitrary Code Execution

severity: high
date: December 4, 2025
Affecting: perl2exe <= V30.10C
CVE: CVE-2024-58278
CVE type: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS: 8.5
CVSS V4 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: ExploitDB-51825
IndigoSTAR Software Vendor Homepage
IndigoSTAR Software Download Page
Credit: decrazyo
Description: perl2exe <= V30.10C contains an arbitrary code execution vulnerability that allows local authenticated attackers to execute malicious scripts. Attackers can control the 0th argument of packed executables to execute another executable, allowing them to bypass restrictions and gain unauthorized access.