MLdonkey versions 2.9.7 and below suffer from a double slash file disclosure vulnerability.
c6acee962a39ddeed5b6b74d1eee84ac2e42340ce2c1020099336bde5c303de0MLdonkey (up to 2.9.7) has a vulnerability that allows remote user to access any
file with rights of running Mldonkey daemon by supplying a
special-crafted request (ok, there's not much special about double
slash) to an Mldonkey http GUI (tcp/4080 usually).
Reference:
https://savannah.nongnu.org/bugs/?25667
Thus, the exploit would be as simple as accessing any file on a remote
host with your browser and double slash:
http://mlhost:4080//etc/passwd
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed