9 lines
No EOL
910 B
Text
9 lines
No EOL
910 B
Text
source: https://www.securityfocus.com/bid/11949/info
|
|
|
|
A vulnerability has been identified in Apple Safari Web Browser that allows an attacker to misrepresent the status bar in the browser, allowing vulnerable users to be mislead into following a link to a malicious site.
|
|
|
|
The issue presents itself when an attacker creates an HTML form with the submit 'value' property set to a legitimate site and the 'action' property set to the attacker-specified site. The malicious form could also be embedded in a link using the HTML Anchor tag and specifying the legitimate site as the 'href' property. As a result, the attacker-supplied link would point to the legitimate site and the status bar would display the address of the legitimate site as well.
|
|
|
|
<form action="http://www.malicious.com/" method="get">
|
|
<a href="http://www.example.com/"><input type="image" src="http://images.example.com/title.gif"></a>
|
|
</form> |