CVE-2002-0980
Internet Explorer 5.5-6.0 - Remote Code Execution via Web Folder Error Message Injection
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2002-0980. PoCs published by http-equiv.
AI-analyzed exploit summary This exploit leverages a vulnerability in Microsoft Outlook Express's MHTML URL handler to execute arbitrary script code in the Local Computer Zone by rendering a malicious .txt file. The PoC demonstrates script execution via an onload event and file navigation.
Description
The Web Folder component for Internet Explorer 5.5 and 6.0 writes an error message to a known location in the temporary folder, which allows remote attackers to execute arbitrary code by injecting it into the error message, then referring to the error message file via a mhtml: URL.
Exploits (1)
This exploit leverages a vulnerability in Microsoft Outlook Express's MHTML URL handler to execute arbitrary script code in the Local Computer Zone by rendering a malicious .txt file. The PoC demonstrates script execution via an onload event and file navigation.