Amit Klein wrote Thursday, June 22, 2006 3:47 AM > So in order to exploit this in HTML over HTTP, the attacker needs to either add/modify the Content-Type response header, or to add/modify the META tag in the HTML page. There are other ways that might carry a bigger injection threat: Style sheet: http://msdn.microsoft.com/library/default.asp?url=/workshop/author/dhtml /reference/properties/charset_1.asp Object property: http://msdn.microsoft.com/library/default.asp?url=/workshop/author/dhtml /reference/properties/charset.asp By extension, it should also work for inline styles.
