Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous

[Richard Moore <rich@xxxxxxxxxxxxxxxx>]

Amit Klein wrote:
> pdp (architect) wrote:
>
> > I will be very quick and just point to links where you can read about
> > this issue.
> >
> > It seams that PDF documents can execute JavaScript code for no
> > apparent reason by using the following template:
> >
> >    
> > http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here 

Works on:

Firefox 2.0.0.1 win32
Firefox 1.5.0.8 win32
Opera 8.5.4 build 770 win32
Opera 9.10.8679 win32

But doesn't work here on IE6 or IE7.

Cheers

Rich.
--
Richard Moore, Principal Software Engineer,
Westpoint Ltd,
Albion Wharf, 19 Albion Street, Manchester, M1 5LN, England
Tel: +44 161 237 1028
Fax: +44 161 237 1031

----------------------------------------------------------------------------
The Web Security Mailing List: 
http://www.webappsec.org/lists/websecurity/

The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/archive/
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]