Exploitation Summary
EIP tracks 1 public exploit for CVE-2004-1166. PoCs published by Albert Puigsech Galicia.
AI-analyzed exploit summary This exploit leverages a URI sanitization flaw in Microsoft Internet Explorer to inject arbitrary FTP commands, allowing attackers to execute commands like PORT and RETR or send emails via SMTP without user interaction.
Description
CRLF injection vulnerability in Microsoft Internet Explorer 6.0.2800.1106 and earlier allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded newline ("%0a") before the FTP command, which causes the commands to be inserted into the resulting FTP session, as demonstrated using a PORT command.
Exploits (1)
This exploit leverages a URI sanitization flaw in Microsoft Internet Explorer to inject arbitrary FTP commands, allowing attackers to execute commands like PORT and RETR or send emails via SMTP without user interaction.