CVE-2009-1879

Adobe Flex SDK < 3.4 - Cross-Site Scripting via Query String in index.template.html

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-1879. PoCs published by Adam Bixby.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in Adobe Flex SDK versions prior to 3.4. The vulnerability arises from improper sanitization of user-supplied input in express-install template files, allowing arbitrary script execution in the context of the web application.

Description

Cross-site scripting (XSS) vulnerability in index.template.html in the express-install templates in the SDK in Adobe Flex before 3.4, when the installed Flash version is older than a specified requiredMajorVersion value, allows remote attackers to inject arbitrary web script or HTML via the query string.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Adam Bixby · textwebappsmultiple
https://www.exploit-db.com/exploits/33180

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Adobe Flex SDK versions prior to 3.4. The vulnerability arises from improper sanitization of user-supplied input in express-install template files, allowing arbitrary script execution in the context of the web application.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Adobe Flex SDK < 3.4
No auth needed
Prerequisites: A web application built using a vulnerable version of Adobe Flex SDK · Ability to inject malicious input into the template file URL
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1022748
Patch, Vendor Advisory x_refsource_confirm
http://www.adobe.com/support/security/bulletins/apsb09-13.html
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/505948/100/0/threaded
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/36374

Scores

EPSS 0.0825
EPSS Percentile 94.2%

Details

CWE
CWE-79
Status published
Products (1)
adobe/flex_sdk < 3.4
Published Aug 21, 2009
Tracked Since Feb 18, 2026