Microsoft Uncompiled HTML Help CHM File - XML External Entity Injection
CHM Files are usually created using Microsofts "HTML Help Workshop" program. However, I find a way to bypass using this program and create them easily by simply adding double .chm extension to the file ".chm.chm". Compiled HTML Help "hh.exe" will then respect and open it processing any JS/HTML/XML inside etc. Compiled HTML Help is also vulnerable to XML External Entity attacks allowing remote attackers to steal and exfiltrate local system files.
http://hyp3rlinx.altervista.org/advis...
Note: If video is blurry change settings to HD.