Aviv Raff has discovered a vulnerability in Internet Explorer 7, which can be exploited by malicious people to conduct phishing attacks.

An input validation error exists in the local resource page "navcancl.htm" when generating the "Refresh the page" link. This can be exploited to inject arbitrary script code to e.g. spoof the contents of an arbitrary site when the user clicks on the "Refresh the page" link.

Secunia has constructed a test, which can be used to check if your browser is affected by this issue:
http://secunia.com/Internet_Explorer_7_navcancl.htm_Cross-Site_Scripting_Vulnerability/

The vulnerability is confirmed in Internet Explorer 7 on a fully patched Windows XP SP2 system. Other versions may also be affected.

Solution
Apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
Aviv Raff

Changelog
Further details available to Secunia VIM customers

Original Advisory
MS07-033 (KB933566):
http://www.microsoft.com/technet/security/Bulletin/MS07-033.mspx

Aviv Raff:
http://aviv.raffon.net/2007/03/14/PhishingUsingIE7LocalResourceVulnerability.aspx

Deep Links
Links available to Secunia VIM customers