Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have the following code in an SWF file that a vulnerability scanner marks as XSS:

// Action0
    {
        var __callResult_6 = getURL(_root.thankYou, "_self");
        var __callResult_7 = stop();

    }

How can it be exploited and how can it be patched if exploitable?

share|improve this question

migrated from serverfault.com Dec 15 '11 at 11:22

This question came from our site for professional system and network administrators.

1 Answer 1

You'll find a detailed description of the issue HERE

share|improve this answer
6  
Please provide some actual content that addresses the question in your answer - not just a link. –  Iszi Dec 15 '11 at 14:51
2  
I want to speak up in defense of SinistraD. His link is exactly spot-on. It completely answers the question. I wish people would stop giving SinistraD a hard time. I don't see any reason why it helps anyone in the world to try to write the explanation found at that link here, all over again. Heaven forbid I should have to lift my index finger and click on a link. (And if the link disappears, just use archive.org. It's not rocket science.) –  D.W. Dec 19 '11 at 5:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.