Microsoft Internet Explorer 5/6 MSXML XML File Parsing Cross-Site Scripting Vulnerability

2003-06-17T00:00:00
ID EDB-ID:22783
Type exploitdb
Reporter GreyMagic Software
Modified 2003-06-17T00:00:00

Description

Microsoft Internet Explorer 5/6 MSXML XML File Parsing Cross-Site Scripting Vulnerability. CVE-2003-0446. Remote exploit for windows platform

                                        
                                            source: http://www.securityfocus.com/bid/7938/info

A vulnerability has been reported for the Microsoft Internet Explorer that may result in cross-site scripting attacks.

If IE, using the MSXML parser, is unable to parse the requested XML file, it will display a parse error that also includes the URL of the requested XML file. In some cases malicious HTML code will not be properly sanitized from the URL, thereby resulting in the execution of script code.

Exploitation may allow theft of cookie-based authentication credentials or other attacks.

http://host.with.unparsable.xml.file/flaw.xml?<script>alert(document.cookie)</script>