Rich Cannings

The issue is related to a cross-site scripting (XSS) vulnerability in ActionScript within arbitrary Shockwave Flash (SWF) files created by InfoSoft FusionCharts. This allows remote attackers to inject arbitrary additional SWF content via a URL in the SRC attribute of an IMG element in the `dataURL` parameter.

The issue allows remote attackers to inject arbitrary web script or HTML via a SWF file that uses the `asfunction:` protocol or the `navigateToURL` function when used with the Flash Player ActiveX Control in Internet Explorer.