Exploitation: Once the user open the document the OLE object is updated trhough the link and mshta is execute thanks to the application/hta content-type delivered by the server Result: code is executed !