bugtraq - Curious vulnerability in Excel 2007

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20080426150026.8688.qmail@securityfocus.com>
Date: 26 Apr 2008 15:00:26 -0000
From: jplopezy@...il.com
To: bugtraq@...urityfocus.com
Subject: Curious vulnerability in Excel 2007

Product: Microsoft Excel 2007 
OS: Windows XP 

Hello 

inform them that, I found a vulnerability in curiosity rather excel, it is that you can run Javascript code (XSS), it seems certain there html tags that excel those injected with these and other code can execute javascript, so this curious flaw is that following the execution of the xss excel breaks, discussing this with a debugger the result is as follows .. 

Access violation when reading [00000034]

Well the procedure for conducting the test is fairly basic concept down here leave an address where the xss only have to select it and copy it to an Excel spreadsheet and may see vulnerability.

(will have to see the source code of the page because txt files in geocities interpret tags ...)

http://es.geocities.com/jplopezy/excelxss.txt

greetings!

Juan Pablo Lopez Yacubian