[Full-disclosure] New flaw found in Firefox 22.214.171.124: Firefox file input focus vulnerabilities
hardwick.carl at gmail.com
Sat Jun 30 16:14:39 BST 2007
PoC here: http://yathong.googlepages.com/FirefoxFocusBug.html
The vulnerability allows the attacker to silently redirect focus of
selected key press events to an otherwise protected file upload form
field. This is possible because of how onKeyDown event is handled,
allowing the focus to be moved between the two. This enables the
attacker to read arbitrary files on victim's system.
Full-Disclosure is hosted and sponsored by Secunia.