Yahoo! Messenger 8.0 - Notification Message HTML Injection

Author: Hai Nam Luke
type: dos
platform: windows
port: 
date_added: 2007-01-26 
date_updated: 2013-11-11 
verified: 1 
codes: CVE-2007-0768;OSVDB-31674 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/22269/info

Yahoo! Messenger is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the context of a victim's Internet Explorer temporary folder. This may help the attacker steal information and launch other attacks.

Versions prior to 2.1.0.29 are vulnerable to this issue.

1. Firstname: example example example example ? ( as long as victim cant see the lastname)
2. Lastname: <img src="javascript:alert('Executed from ' + top.location)" >
3. Request to add victim ID to your contact list.
4. Once victim accepts your request, send him a message and change your online status (Available -> Invisible)