CVE-2003-0228

published 2003-05-27

CVE-2003-0228: Directory traversal vulnerability in Microsoft Windows Media Player 7.1 and Windows Media Player for Windows XP allows remote attackers to execute arbitrary…

Priority P3 42 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

Directory traversal vulnerability in Microsoft Windows Media Player 7.1 and Windows Media Player for Windows XP allows remote attackers to execute arbitrary code via a skins file with a URL containing hex-encoded backslash characters (%5C) that causes an executable to be placed in an arbitrary location.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
microsoft	windows_media_player	—	—

Detection & IOCs extracted from sources · hover to see the quote

path %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cDocuments%20and%20Settings%5CAll%20Users%5CStart%20Menu%5CPrograms%5CStartup%5c↗

path %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cDocuments%20and%20Settings%5CAll%20Users%5CMenu Start%5CProgramma%27s%5Copstarten%5c↗

filename *.wmz↗

• → Detect directory traversal in WMP skin file download requests by looking for hex-encoded backslash sequences (%5C or %5c) combined with hex-encoded dot-dot sequences (%2e%2e) in HTTP Content-Disposition or URL parameters targeting .wmz files. ↗
• → Monitor for files written to the Windows Startup folder (All Users\Start Menu\Programs\Startup) by the Windows Media Player process, which would indicate successful exploitation dropping a payload for persistence. ↗
• → Inspect HTTP responses serving .wmz files for a Content-Disposition header containing both percent-encoded traversal sequences (%2e%2e%5c) and a null byte (%00) before the .wmz extension, which is the exploit delivery mechanism. ↗
• → Flag HTTP responses with Content-Type 'application/download' delivering a .wmz skin file where the filename path contains four or more consecutive %2e%2e%5c traversal segments. ↗

• · The exploit targets both English and Dutch Windows XP locale Startup folder paths; detection rules must account for both locale-specific path variants to avoid missed detections. ↗
• · The vulnerability requires a secondary execution step — the malicious file is dropped to a known location (Startup folder) and executed through some other means, not directly by WMP itself. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.