CVE-2002-1187
Internet Explorer 5.01-6.0 - Cross-Site Scripting via Frame or IFrame Element
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2002-1187. PoCs published by GreyMagic Software.
AI-analyzed exploit summary This exploit leverages a cross-domain security flaw in Microsoft Internet Explorer where a parent window can manipulate the frames of a child window from a different domain or security zone. By setting the frame's location to a 'javascript:' URL, arbitrary script execution is achieved in the context of the child domain.
Description
Cross-site scripting vulnerability (XSS) in Internet Explorer 5.01 through 6.0 allows remote attackers to read and execute files on the local system via web pages using the <frame> or <iframe> element and javascript, aka "Frames Cross Site Scripting," as demonstrated using the PrivacyPolicy.dlg resource.
Exploits (1)
This exploit leverages a cross-domain security flaw in Microsoft Internet Explorer where a parent window can manipulate the frames of a child window from a different domain or security zone. By setting the frame's location to a 'javascript:' URL, arbitrary script execution is achieved in the context of the child domain.