Exploitation Summary
EIP tracks 1 public exploit for CVE-2001-0089. PoCs published by Key.
AI-analyzed exploit summary This exploit leverages a design flaw in the INPUT TYPE=FILE HTML form element to trick users into uploading known files from their local system. The VBScript manipulates key presses to inject a predefined file path (e.g., C:\WINNT\REPAIR\SAM._) into the file input field, potentially exposing sensitive information.
Description
Internet Explorer 5.0 through 5.5 allows remote attackers to read arbitrary files from the client via the INPUT TYPE element in an HTML form, aka the "File Upload via Form" vulnerability.
Exploits (1)
This exploit leverages a design flaw in the INPUT TYPE=FILE HTML form element to trick users into uploading known files from their local system. The VBScript manipulates key presses to inject a predefined file path (e.g., C:\WINNT\REPAIR\SAM._) into the file input field, potentially exposing sensitive information.