what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

ICQ 6.5 HTML Injection

ICQ 6.5 HTML Injection
Posted Aug 15, 2009
Authored by ShineShadow

ICQ version 6.5 suffers from a HTML injection vulnerability.

tags | exploit
SHA-256 | 47e5107f4c6fbacd60b513e4af30bb3ea087276cc908d5e80cdc241f35e569bc

ICQ 6.5 HTML Injection

Change Mirror Download
ShineShadow Security Report  14082009-08


ICQ 6.5 HTML-injection vulnerability


With more than 700 million instant messages sent and received every day, ICQ has been known to the online community as a messaging service. Today, a little more than a decade after the first ICQ instant messaging service was launched it has become much more than just that.
ICQ is a personal communication tool that allows users to meet and interact through instant messaging services such as text, voice, video and VoIP as well as various entertainment and community products.

Source: http://www.icq.com


ICQ 6.5 build 1042 (latest build)
Previous versions and localized distributions may also be affected


HTML-injection vulnerability exists in official ICQ client software. Incoming message window in the vulnerable ICQ client has a web browser nature. An attacker can try to exploit the vulnerability by sending specially crafted message to the remote ICQ client. The malicious message can contain text data which will be interpreted and displayed in the incoming message window as a HTML code. Potentially an arbitrary HTML code could be injected.
There are two impacts of the vulnerability has been detected:
1.Information disclosure
For example, an attacker can inject <IMG> tag that could lead information disclosure (such as remote client’s IP address, browser version, OS version, etc.)
An attacker can spoof ICQ client software’s system messages, interface elements (buttons, links) in the message window, etc. For example, it could be used for forcing of the ICQ users to click on attacker’s malicious link.
Maybe other impacts are possible.


Remote attacker can exploit this vulnerability using any instant messenger software with OSCAR (ICQ) protocol support by sending specially crafted message.
Example of exploit message:
file://1"></a>[HTML CODE]
Notice that internal ICQ antispam engine will blocked some text/html data if attacker’s ICQ UIN not in user’s ICQ contact list.


The “Full disclosure” policy has been applied. Vendor has not been contacted.


Maxim A. Kulakov (aka ShineShadow)
Login or Register to add favorites

File Archive:

June 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    19 Files
  • 2
    Jun 2nd
    16 Files
  • 3
    Jun 3rd
    28 Files
  • 4
    Jun 4th
    0 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    19 Files
  • 7
    Jun 7th
    23 Files
  • 8
    Jun 8th
    11 Files
  • 9
    Jun 9th
    10 Files
  • 10
    Jun 10th
    4 Files
  • 11
    Jun 11th
    0 Files
  • 12
    Jun 12th
    0 Files
  • 13
    Jun 13th
    0 Files
  • 14
    Jun 14th
    0 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    27 Files
  • 20
    Jun 20th
    65 Files
  • 21
    Jun 21st
    10 Files
  • 22
    Jun 22nd
    8 Files
  • 23
    Jun 23rd
    6 Files
  • 24
    Jun 24th
    6 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    15 Files
  • 28
    Jun 28th
    14 Files
  • 29
    Jun 29th
    11 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By