Exploit Microsoft Internet Explorer 5/6 - MSXML XML File Parsing Cross-Site Scripting

[Exploiter]

EDB-ID

22783

Проверка EDB

1. Пройдено

Автор

GREYMAGIC SOFTWARE

Тип уязвимости

REMOTE

Платформа

WINDOWS

CVE

cve-2003-0446

Дата публикации

2003-06-17

source: https://www.securityfocus.com/bid/7938/info

A vulnerability has been reported for the Microsoft Internet Explorer that may result in cross-site scripting attacks.

If IE, using the MSXML parser, is unable to parse the requested XML file, it will display a parse error that also includes the URL of the requested XML file. In some cases malicious HTML code will not be properly sanitized from the URL, thereby resulting in the execution of script code.

Exploitation may allow theft of cookie-based authentication credentials or other attacks.

http://host.with.unparsable.xml.file/flaw.xml?<script>alert(document.cookie)</script>