Where does the destoon storage xss address?

Where does the destoon storage xss address?

The member sends a letter and uploads an attachment. Files in swf format can be uploaded,

The <embed> label is not filtered.

We construct a malicious swf. For example
 

Upload the attachment f12 and view the code to obtain the swf path. Submit captured packets

<Embed src = "http: // localhost/file/upload/201407/23/21-48-13-93-4.swf">
 

Triggered when you view the SMS
 

Because of the same domain, this swf can be used to steal cookies.

Solution:

Swf cannot be uploaded.