Microsoft Internet Explorer 5/6 MSXML XML File Parsing Cross-Site Scripting Vulnerability

2014-07-01T00:00:00
ID SSV:76577
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00

Description

No description provided by source.

                                        
                                            
                                                source: http://www.securityfocus.com/bid/7938/info

A vulnerability has been reported for the Microsoft Internet Explorer that may result in cross-site scripting attacks.

If IE, using the MSXML parser, is unable to parse the requested XML file, it will display a parse error that also includes the URL of the requested XML file. In some cases malicious HTML code will not be properly sanitized from the URL, thereby resulting in the execution of script code.

Exploitation may allow theft of cookie-based authentication credentials or other attacks.

http://host.with.unparsable.xml.file/flaw.xml?<script>alert(document.cookie)</script>