12 lines
No EOL
385 B
Text
12 lines
No EOL
385 B
Text
# Stefano Di Paola
|
|
# http://www.wisec.it/
|
|
|
|
From Secunia:
|
|
Input passed to a hosted PDF file is not properly sanitised by the browser plug-in
|
|
before being returned to users. This can be exploited to execute arbitrary script code in
|
|
a user's browser session in context of an affected site.
|
|
|
|
Example:
|
|
- http://[host]/[filename].pdf#[some text]=javascript:[code]
|
|
|
|
# milw0rm.com [2007-01-05] |