In the course of a pentest I found a Flash movie file (swf) that loads another Flash movie through loadMovie. The HTML is this:

<embed width="388" height="350" src="http://www.pollo.com/first_flash.swf?
videoload=http://www.pollo.com/videos/second_flash" quality="high" 
pluginspage="http://www.macromedia.com/go/getflashplayer" align="middle" 
play="true" loop="true" scale="showall" wmode="window" devicefont="false" 
bgcolor="#ffffff" name="interior" menu="true" allowfullscreen="false" 
allowscriptaccess="sameDomain" salign="" type="application/x-shockwave-flash">

As you can see, there is the directive allowscriptaccess="sameDomain". Also, if you access the Flash file directly I understand that recent Flash plugins use this setting as default.

In the first_flash.swf, I found this code that loads the second movie:

_root.videourl = _root.videoload + '.swf';
video.loadMovie(_root.videourl);

I have tested I can actually change the videoload variable to load swf from other domains. But I can't seem to execute javascript with getURL on a second_flash.swf controlled by me.

So my question is, what can I do to exploit this poor design? How can I show that it is, in fact, dangerous?

In the course of a pentest I found a Flash movie file (swf) that loads another Flash movie through loadMovie. The HTML is this:

<embed width="388" height="350" src="http://www.domain.com/first_flash.swf?
videoload=http://www.domain.com/videos/second_flash" quality="high" 
pluginspage="http://www.macromedia.com/go/getflashplayer" align="middle" 
play="true" loop="true" scale="showall" wmode="window" devicefont="false" 
bgcolor="#ffffff" name="interior" menu="true" allowfullscreen="false" 
allowscriptaccess="sameDomain" salign="" type="application/x-shockwave-flash">

As you can see, there is the directive allowscriptaccess="sameDomain". Also, if you access the Flash file directly I understand that recent Flash plugins use this setting as default.

In the first_flash.swf, I found this code that loads the second movie:

_root.videourl = _root.videoload + '.swf';
video.loadMovie(_root.videourl);

I have tested I can actually change the videoload variable to load swf from other domains. But I can't seem to execute javascript with getURL on a second_flash.swf controlled by me.

So my question is, what can I do to exploit this poor design? How can I show that it is, in fact, dangerous?