I have found two vulnerabilities on my college site and I want to report them but don't know if these are "really" vulnerabilities :

  1. RFI inside SWF file.

Example: https://www.site.com/opis.swf?sTitle=Vulnerable&sDesc=Again vulnerable&sPrice=Vulnerable&sCoverFront=http://www.neurosciencemarketing.com/blog/wp-content/photos/smiley1.jpg&sCoverBack=http://www.neurosciencemarketing.com/blog/wp-content/photos/smiley1.jpg&sBuyLink=http://www.google.com&sPath=http://www.neurosciencemarketing.com/blog/wp-content/photos/smiley1.jpg

As you can see sTitle and sDesc are text values , sCoverFront and sCoverBack are .jpg, sBuyLink is redirection url (my ideas is XSS vector: data:text/html,alert(document.cookie)) and sPath seems to be url for m4u video. Pick of swf applet: <code>http://www.zaslike.com/files/1jt0kj4ve4cpbifj5qlq.jpg</code>

  1. RFI for image source link.

Example: http://site.com/static/Covers.htm?b=http://www.stringfunction.com/img/url-encode-url-decode.jpg&f=http://www.stringfunction.com/img/url-encode-url-decode.jpg

And here is code for src settings:

<body onload="resizeToCovers()"><div id="resizer"></div>
    <table cellspacing="0" cellpadding="0"><tr><td><img src="" id="frontBoxCover" /></td><td><img src="" id="backBoxCover" /></td></tr></table>
  <script type="text/javascript">
    var boxFront;
    var boxBack;
    boxFront = document.getElementById("frontBoxCover");
    boxBack = document.getElementById("backBoxCover");
    var qs = new Querystring();
    var newF =  qs.get('f','');
    boxFront.src = newF;
    var newB = qs.get('b', '');
    if(newB == ''){
        boxBack.style.displayFormat = "none";
    boxBack.src = newB;

And for Querystring:

/* Client-side access to querystring name=value pairs
    Version 1.2.3
    22 Jun 2005
    Adam Vandenberg
function Querystring(qs) { // optionally pass a querystring to parse
    this.params = new Object()

    if (qs == null)

    if (qs.length == 0) return;

// Turn <plus> back to <space>
// See: http://www.w3.org/TR/REC-html40/interact/forms.html#h-
    qs = qs.replace(/\+/g, ' ')
    var args = qs.split('&') // parse out name/value pairs separated via &

// split out each name=value pair
    for (var i=0;i<args.length;i++) {
        var value;
        var pair = args[i].split('=')
        var name = unescape(pair[0])

        if (pair.length == 2)
            value = unescape(pair[1])
            value = name

        this.params[name] = value

function Querystring_get(key, default_) {
    // This silly looking line changes UNDEFINED to NULL
    if (default_ == null) default_ = null;

    var value=this.params[key]
    if (value==null) value=default_;

    return value;

Is there any vuln in these, are they worth of reporting. Thank you.

  • It was confusing for me to understand your question. If you're asking if it's a risk to permit the URL can be altered (sTitle and sDesc) and have that display directly in the flash object, please clarify your question. Also, use this site's editing tools to embed your JPEG that is located on zaslike.com – halfbit Nov 28 '12 at 17:32
  • Yes that is what I want to know I don't want to tell system admin : "Hey you have vulnerability , I can show my picture on your site" , seems kind of funny :) . Is there any way that this kind of "vulnerability" can be exploited any further. Seems like no other files can be included . – Daniel Nov 28 '12 at 17:42

I wrote a few blog posts about this a while back.

http://erlend.oftedal.no/blog/?blogid=103 http://erlend.oftedal.no/blog/?blogid=99

Especially the XSS is a problem, but also displaying random pictures on a trusted website can be a bad thing. Think political or racist messages or porn. The URL starts with something the users trust, but you end up at something very different.


If I were creating this, I would avoid any type of RFI (whether it can be practically exploited or not doesn't matter). If a hole exists but there seems to be no risk, it's just asking for trouble. I would let the webmaster or whoever you think you should contact know what you found. Linking to some vulnerabilities regarding remote file inclusion will help bring your point across. This is a good resource

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.