MSIEv6 % encoding causes a problem again

Type securityvulns
Reporter Securityvulns
Modified 2002-09-04T00:00:00


it's about cross-site scripting at MSIEv6 client side using % encoding, but not the same as the one by which doesn't work on my PC.

[tested]MSIEv6(CN version) {IEXPLORE.EXE file version: 6.0.2600.0000} {MSHTML.DLL file version: 6.00.2600.0000}

[demo] at or ==> 2FforMSIE-MyPage section.

[exp] %?? in URL is decoded when IE caculates the domain, but not decoded while downloading a page. so [CODE.URL] ( 2F=hex$(asc('/')) ) leads to instead of, and the domain of it for IE

Very simple, that's all.