Description
Visual truncation vulnerability in Gadu-Gadu allows remote attackers to spoof the file extension on transmitted files via a filename with a large number of spaces followed by the real extension, which is not displayed in the dialog box.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Gadu-Gadu 6.0 - File Download Filename Obfuscation EDB-24404 · remote · Aug 23, 2004 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- gadu-gadu-file-ext-spoof(17105) vdb-entry
- 20040821 GADU-GADU Instant messanger - long file name mailing-list
- 9162 vdb-entry
- 1011037 vdb-entry
- 11017 vdb-entry