TorrentTrader Download.PHP SQL Injection Vulnerability
BID:11087
Info
TorrentTrader Download.PHP SQL Injection Vulnerability
| Bugtraq ID: | 11087 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 01 2004 12:00AM |
| Updated: | Sep 01 2004 12:00AM |
| Credit: | Disclosure of this issue is credited to "acidbits ." <[email protected]>. |
| Vulnerable: |
TorrentTrader BitTorrent Tracker 2.0 TorrentTrader BitTorrent Tracker 1.0 beta RC2 TorrentTrader BitTorrent Tracker 1.0 beta RC1 TorrentTrader BitTorrent Tracker 1.0 beta TorrentTrader BitTorrent Tracker 1.0 alpha |
| Not Vulnerable: | |
Discussion
TorrentTrader Download.PHP SQL Injection Vulnerability
TorrentTrader is vulnerable to a remote SQL injection vulnerability in the 'download.php' script. This issue is due to a failure of the application to properly validate user-supplied input prior to including it in an SQL query.
An attacker may exploit this issue to manipulate and inject SQL queries onto the underlying database. It will be possible to leverage this issue to steal database contents including administrator password hashes and user credentials as well as to make attacks against the underlying database.
TorrentTrader is vulnerable to a remote SQL injection vulnerability in the 'download.php' script. This issue is due to a failure of the application to properly validate user-supplied input prior to including it in an SQL query.
An attacker may exploit this issue to manipulate and inject SQL queries onto the underlying database. It will be possible to leverage this issue to steal database contents including administrator password hashes and user credentials as well as to make attacks against the underlying database.
Exploit / POC
TorrentTrader Download.PHP SQL Injection Vulnerability
No exploit is required to leverage this issue. The following proof of concept exploit has been provided:
No exploit is required to leverage this issue. The following proof of concept exploit has been provided:
Solution / Fix
TorrentTrader Download.PHP SQL Injection Vulnerability
Solution:
The vendor has released the following manual fix, users are advised to carry out these changes as soon as possible:
- Open your download.php file
- Find this :
//$id = $_GET["id"];
around line 7 and replace it by this
$id = (int)$_GET["id"];
Solution:
The vendor has released the following manual fix, users are advised to carry out these changes as soon as possible:
- Open your download.php file
- Find this :
//$id = $_GET["id"];
around line 7 and replace it by this
$id = (int)$_GET["id"];
References
TorrentTrader Download.PHP SQL Injection Vulnerability
References:
References:
- Project Home Page (TorrentTrader)
- SECURITY FIX: Risk of SQL Injection ! (TorrentTrader)