Infodraw Media Relay Service Directory Traversal Vulnerability Allowing Arbitrary File Read

A directory traversal vulnerability has been identified in Infodraw Media Relay Service (MRS) version 7.1.0.0. The issue arises in the MRS web server running on port 12654, where the username field can be manipulated to access arbitrary files by traversing directories. This vulnerability could be exploited to read the ServerParameters.xml file, which may contain administrator credentials either in cleartext or hashed with MD5.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files, including those containing administrator credentials.