CVE-2008-6060

Shockwave Flash - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in ActionScript in arbitrary Shockwave Flash (SWF) files created by InfoSoft FusionCharts allows remote attackers to inject arbitrary additional SWF content via a URL in the SRC attribute of an IMG element in the dataURL parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Rich Cannings · textremotemultiple

https://www.exploit-db.com/exploits/30973

View Code ZIP pw:eip

References (5)

[Various Sources] http://docs.google.com/View?docid=ajfxntc4dmsq_14dt57ssdw

[US Government Resource] http://www.kb.cert.org/vuls/id/249337

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/485722/100/100/threaded

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/27109

[Third Party Advisory] http://www.vupen.com/english/advisories/2008/0067

Scores

EPSS 0.0348

EPSS Percentile 87.4%

Classification

CWE

CWE-79

Status published

Affected Products (2)

infosoftglobal/fusion_charts

n/a/n/a

Timeline

Published Feb 05, 2009

Tracked Since Feb 18, 2026