Microsoft Internet Explorer contains a vulnerability that allows attackers to spoof the extension presented in the file download dialog. When the file is written to disk, an executable extension (hta) is appended to the file name but it doesn´t appear in the file download completed dialog. This could trick users into opening an executable file thinking it is, for instance, an innocent document or picture.
a P.O.C. is provided. To download it, click the "Read more" link and then click the link to the P.O.C file.