Exploitation Summary
EIP tracks 1 public exploit for CVE-2003-0838. PoCs published by http-equiv.
AI-analyzed exploit summary This exploit leverages a vulnerability in Internet Explorer where improper handling of object types in popup windows allows arbitrary code execution. The PoC uses JavaScript to create a popup with an object tag pointing to a malicious PHP file.
Description
Internet Explorer allows remote attackers to bypass zone restrictions to inject and execute arbitrary programs by creating a popup window and inserting ActiveX object code with a "data" tag pointing to the malicious code, which Internet Explorer treats as HTML or Javascript, but later executes as an HTA application, a different vulnerability than CVE-2003-0532, and as exploited using the QHosts Trojan horse (aka Trojan.Qhosts, QHosts-1, VBS.QHOSTS, or aolfix.exe).
Exploits (1)
This exploit leverages a vulnerability in Internet Explorer where improper handling of object types in popup windows allows arbitrary code execution. The PoC uses JavaScript to create a popup with an object tag pointing to a malicious PHP file.