OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Thor Larholm (Thorjubii.dk)
Date: Thu Jun 06 2002 - 16:55:53 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    I was a bit confused as to whether this had to be triggered _from_ the My
    Computer zone, but tests quickly proofed that this is definitely remotely
    exploitable.

    To clear things up, this is yet another XSS vulnerability that allows
    arbitrary HTML to be inserted in the My Computer zone. This makes it quite
    easy to e.g. execute arbitrary commands, undoubtedly a more fun
    demonstration:

    http://jscript.dk/Jumper/xploit/ftpfolderview.html

    Status: 18 unpatched vulnerabilities.

    http://jscript.dk/Unpatched/

    Regards
    Thor Larholm
    Jubii A/S - Internet Programmer