Top 10 winner

XSS Vulnerabilities in Common Shockwave Flash Files

Rich Cannings · Google Docs · 2 January 2008

Web authoring tools stamp the same vulnerable ActionScript into every SWF they generate, so hundreds of thousands of sites inherit XSS. Dreamweaver's skinName, Adobe Connect's baseurl, FusionCharts' dataURL, Camtasia's csPreloader and Autodemo's onend all pass attacker input to URL loaders, reachable through asfunction:getURL with a javascript: payload or by loading a remote SWF for cross-site flashing.

Record

Researcher

Rich Cannings

Published by

Google Docs

Date

2 January 2008

Topic

XSS

In the archive

• Ranked #1 in the 2007 Top 10 Web Hacking Techniques

Tags

• flash
• xss
• filter-bypass
• open-redirect
• large-scale-scan
• mitigation
• owasp-a03-2021
• owasp-a04-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Rich Cannings, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 September 2026.