Flash xss 0day in phpwind

I have recently submitted flash-related vulnerabilities for many Daniel. One flash file used in the latest PHPWIND version has the xss vulnerability. If there are so many flash files, I will directly report the vulnerability.
1, file location http://www.phpwind.net/res/images/uploader.swf 2, through the swf file decompile get as code, find the "ExternalInterface. call is a key function that is used in the Code, for example, ExternalInterface. call (this. jsobject + ". initflash ");, 3. trace this. the jsobject variable has the following code: this. jsobject = this. loaderInfo. parameters ["jsobject"]; directly through loaderInfo. parameters. No filtering or check is performed. 4. directly construct poc http://www.phpwind.net/res/images/uploader.swf? Jsobject = alert (1)} catch (e ){}//
Solution:Filter out special characters based on actual conditions, or only allow the parameter to contain letters and numbers.