Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I found this - can anyone provide me examples of how these issues are exploited?

share|improve this question
up vote 3 down vote accepted

Flash is jailed by the some-origin policy and can only act upon a site that loads the flash applet with scripting access enabled.

However, flash can become a vector for XSS. The demo above lists various XSS vectors. So for example in the extremely unlikely condition where you are loading a flash applet where the attacker can control the loadMovieNumVar variable then an attacker could execute JavaScript in the context of the site by setting this variable to javascript:alert('gotcha!').

XSS is extremely common and there are many ways that this attack can manifest. Flash based XSS is one way, and its also extremely uncommon.

share|improve this answer
So if attacker finds url like this : he can try to exploit xss issue? – khaomax Dec 6 '12 at 18:43
@user1203028 No... flash doesn't usually accept GET parameters like that, that is usually used by server-side code. Flash accepts these parameters defined in the <object> tag. – rook Dec 6 '12 at 18:45
So if user input is reflected anywhere inside these dangerous parameters , than XSS can be exploited.Since GET is not an option. – khaomax Dec 6 '12 at 19:07
@user1203028 yep – rook Dec 6 '12 at 19:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.