Microsoft Internet Explorer 5/6 - MSXML XML File Parsing Cross-Site Scripting

source: https://www.securityfocus.com/bid/7938/info

A vulnerability has been reported for the Microsoft Internet Explorer that may result in cross-site scripting attacks.

If IE, using the MSXML parser, is unable to parse the requested XML file, it will display a parse error that also includes the URL of the requested XML file. In some cases malicious HTML code will not be properly sanitized from the URL, thereby resulting in the execution of script code.

Exploitation may allow theft of cookie-based authentication credentials or other attacks.

http://host.with.unparsable.xml.file/flaw.xml?<script>alert(document.cookie)</script>