Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/

SYNTHESIS OF THE VULNERABILITY

An attacker can send an HTML MMS, using a refresh, in order to
generate a Cross Site Scripting.

– Severity: 2/4
– Creation date: 23/04/2010

DESCRIPTION OF THE VULNERABILITY

The "meta http-equiv=refresh" directive of an HTML document
redirects the visitor to another url.

The "Show Message" configuration of HTC Touch Pro 2 mobiles
directly displays the content of received messages. However, if
the message uses an "meta http-equiv=refresh", its script code is
run in the context of the pointed web site.

An attacker can therefore send an HTML MMS, using a refresh, in
order to generate a Cross Site Scripting.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/Windows-Mobile-Cross-Site-Scripting-via-MMS-9605