Hacker News Reader

> No idea - but it's a common exploit used to DL a torrent then run a post DL script .bat file to DL and run a crypto miner.

Who or what triggers the execution of that script? If it is QBT, it almost sounds like malicious intent from the side of its developers.

View on HN

Perhaps this is what they were talking about: https://www.cvedetails.com/cve/CVE-2019-13640/

> In qBittorrent before 4.1.7, the function Application::runExternalProgram() located in app/application.cpp allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, as demonstrated by remote command execution via a crafted name within an RSS feed.

Reply on news.ycombinator.com