In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading arbitrary files via ../ directory traversal in the username field. Reading ServerParameters.xml may reveal administrator credentials in cleartext or with MD5 hashing.

Aura Digital Security 101

Aura's team of experts are here to guide you on topics like identity theft, credit & finance, fraud prevention, internet safety & digital security.