Bugtraq: RE: Bypassing of web filters by using ASCII

["James C. Slora Jr." <james.slora () phra com>]

Amit Klein wrote Thursday, June 22, 2006 3:47 AM

> So in order to exploit this in HTML over HTTP, the attacker needs to
either add/modify the Content-Type response header, or to add/modify the
META tag in the HTML page.

There are other ways that might carry a bigger injection threat:

Style sheet:
http://msdn.microsoft.com/library/default.asp?url=/workshop/author/dhtml
/reference/properties/charset_1.asp

Object property:
http://msdn.microsoft.com/library/default.asp?url=/workshop/author/dhtml
/reference/properties/charset.asp


By extension, it should also work for inline styles.