Exploit Apple Safari Web Browser 1.x - HTML Form Status Bar Misrepresentation

[Exploiter]

EDB-ID

24843

Проверка EDB

1. Пройдено

Автор

GUILLAUME

Тип уязвимости

DOS

Платформа

OSX

CVE

N/A

Дата публикации

2004-12-15

Apple Safari Web Browser 1.x - HTML Form Status Bar Misrepresentation

source: https://www.securityfocus.com/bid/11949/info

A vulnerability has been identified in Apple Safari Web Browser that allows an attacker to misrepresent the status bar in the browser, allowing vulnerable users to be mislead into following a link to a malicious site.

The issue presents itself when an attacker creates an HTML form with the submit 'value' property set to a legitimate site and the 'action' property set to the attacker-specified site. The malicious form could also be embedded in a link using the HTML Anchor tag and specifying the legitimate site as the 'href' property. As a result, the attacker-supplied link would point to the legitimate site and the status bar would display the address of the legitimate site as well.

<form action="http://www.malicious.com/" method="get">
<a href="http://www.example.com/"><input type="image" src="http://images.example.com/title.gif"></a>
</form>