CVE-2015-6127

This exploit leverages a vulnerability in Windows Media Center where a crafted .mcl file can trick the application into rendering itself as an HTML file, allowing arbitrary local file reads via JavaScript and exfiltration to a remote server.

This exploit leverages a vulnerability in Microsoft Windows Media Center (MS15-134) to render an MCL file as an HTML document in the local machine zone, allowing file leakage via JavaScript. It uses an XMLHttpRequest to exfiltrate specified files to an attacker-controlled server.