Exploit Microsoft Internet Explorer 5.x - Valid File Drag and Drop Embedded Code (MS04-038)

[Exploiter]

EDB-ID

24693

Проверка EDB

1. Пройдено

Автор

HTTP-EQUIV

Тип уязвимости

REMOTE

Платформа

WINDOWS

CVE

cve-2005-0053

Дата публикации

2004-10-20

Microsoft Internet Explorer 5.x - Valid File Drag and Drop Embedded Code (MS04-038)

source: https://www.securityfocus.com/bid/11466/info

The Microsoft cumulative Internet Explorer patch (MS04-038) attempted to limit what files may be dragged and dropped onto the local computer from the Internet Zone to prevent executable objects from being placed on the file system in this manner. 

However, a number of file types are still permitted for drag and drop operations. It has demonstrated that it is possible to embed hostile HTML and script code in one of these file types, remove the file extension and then allow the operating system to dynamically determine the file type based on its contents.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24693.zip