Skype zero day HTML/(Javascript) code injection
Noptri Public Security Advisory has publised a working skype zero day vulnerability with POC for skype. Skype users need be aware of this vulnerability.
Affected Software:
Software: Skype <=
Affected Platforms:
Windows (XP, Vista, 7)
Problem Description:
Skype suffers from a persistent code injection vulnerability due to a lack
of input validation and output sanitization of following profile entries:
    [+] home
    [+] office
    [+] mobile
Proof of Concept:
The following HTML codes can be used to trigger the described vulnerability:
--- SNIP ---
    [+] Home Phone Number:
    [+] Office Phone Number:
    <center><i>INJECTION HERE</i></center>
    [+] Mobile Phone Number:
    <a href="#">INJECTION HERE</a>
An attacker could for example inject HTML/Javascript code. It has not been verified though, if it's possible to hijack cookies or to attack the underlying operating system. Attacker could give a try using extern .js files...

Found this article interesting? Follow THN on Facebook, Twitter and LinkedIn to read more exclusive content we post.