Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have the following code in an SWF file that a vulnerability scanner marks as XSS:

// Action0
    {
        var __callResult_6 = getURL(_root.thankYou, "_self");
        var __callResult_7 = stop();

    }

How can it be exploited and how can it be patched if exploitable?

share|improve this question

migrated from serverfault.com Dec 15 '11 at 11:22

This question came from our site for system and network administrators.

You'll find a detailed description of the issue HERE

share|improve this answer
6  
Please provide some actual content that addresses the question in your answer - not just a link. – Iszi Dec 15 '11 at 14:51
2  
I want to speak up in defense of SinistraD. His link is exactly spot-on. It completely answers the question. I wish people would stop giving SinistraD a hard time. I don't see any reason why it helps anyone in the world to try to write the explanation found at that link here, all over again. Heaven forbid I should have to lift my index finger and click on a link. (And if the link disappears, just use archive.org. It's not rocket science.) – D.W. Dec 19 '11 at 5:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.