## https://sploitus.com/exploit?id=SAINT:52056D31FA101782A686CB4C05A4AB54
Added: 11/17/2006
CVE: [CVE-2006-5745](<https://vulners.com/cve/CVE-2006-5745>)
BID: [20915](<http://www.securityfocus.com/bid/20915>)
OSVDB: [30208](<http://www.osvdb.org/30208>)
### Background
[Microsoft XML Core Services](<http://msdn.microsoft.com/xml/default.aspx>) includes the XMLHTTP ActiveX control, which allows web pages to send and receive XML data.
### Problem
A memory corruption vulnerability in the XMLHTTP ActiveX control allows command execution when a user loads a web page which calls the setRequestHeader method with invalid parameters.
### Resolution
Apply the patch referenced in [Microsoft Security Bulletin 06-071](<http://www.microsoft.com/technet/security/bulletin/ms06-071.mspx>).
### References
<http://www.kb.cert.org/vuls/id/585137>
### Limitations
Exploit works on Internet Explorer 6 with Microsoft XML Core Services 4.0 Service Pack 2.
Successful exploitation requires a user to load the exploit page into Internet Explorer. There may be a delay before the exploit succeeds due to the large amount of memory required.
### Platforms
Windows