Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have found two vulnerabilities on my college site and I want to report them but don't know if these are "really" vulnerabilities :

  1. RFI inside SWF file.

Example: vulnerable&sPrice=Vulnerable&sCoverFront=

As you can see sTitle and sDesc are text values , sCoverFront and sCoverBack are .jpg, sBuyLink is redirection url (my ideas is XSS vector: data:text/html,alert(document.cookie)) and sPath seems to be url for m4u video. Pick of swf applet: <code></code>

  1. RFI for image source link.


And here is code for src settings:

<body onload="resizeToCovers()"><div id="resizer"></div>
    <table cellspacing="0" cellpadding="0"><tr><td><img src="" id="frontBoxCover" /></td><td><img src="" id="backBoxCover" /></td></tr></table>
  <script type="text/javascript">
    var boxFront;
    var boxBack;
    boxFront = document.getElementById("frontBoxCover");
    boxBack = document.getElementById("backBoxCover");
    var qs = new Querystring();
    var newF =  qs.get('f','');
    boxFront.src = newF;
    var newB = qs.get('b', '');
    if(newB == ''){ = "none";
    boxBack.src = newB;

And for Querystring:

/* Client-side access to querystring name=value pairs
    Version 1.2.3
    22 Jun 2005
    Adam Vandenberg
function Querystring(qs) { // optionally pass a querystring to parse
    this.params = new Object()

    if (qs == null),

    if (qs.length == 0) return;

// Turn <plus> back to <space>
// See:
    qs = qs.replace(/\+/g, ' ')
    var args = qs.split('&') // parse out name/value pairs separated via &

// split out each name=value pair
    for (var i=0;i<args.length;i++) {
        var value;
        var pair = args[i].split('=')
        var name = unescape(pair[0])

        if (pair.length == 2)
            value = unescape(pair[1])
            value = name

        this.params[name] = value

function Querystring_get(key, default_) {
    // This silly looking line changes UNDEFINED to NULL
    if (default_ == null) default_ = null;

    var value=this.params[key]
    if (value==null) value=default_;

    return value;

Is there any vuln in these, are they worth of reporting. Thank you.

share|improve this question
It was confusing for me to understand your question. If you're asking if it's a risk to permit the URL can be altered (sTitle and sDesc) and have that display directly in the flash object, please clarify your question. Also, use this site's editing tools to embed your JPEG that is located on – LamonteCristo Nov 28 '12 at 17:32
Yes that is what I want to know I don't want to tell system admin : "Hey you have vulnerability , I can show my picture on your site" , seems kind of funny :) . Is there any way that this kind of "vulnerability" can be exploited any further. Seems like no other files can be included . – khaomax Nov 28 '12 at 17:42
up vote 2 down vote accepted

I wrote a few blog posts about this a while back.

Especially the XSS is a problem, but also displaying random pictures on a trusted website can be a bad thing. Think political or racist messages or porn. The URL starts with something the users trust, but you end up at something very different.

share|improve this answer

If I were creating this, I would avoid any type of RFI (whether it can be practically exploited or not doesn't matter). If a hole exists but there seems to be no risk, it's just asking for trouble. I would let the webmaster or whoever you think you should contact know what you found. Linking to some vulnerabilities regarding remote file inclusion will help bring your point across. This is a good resource

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.