J-Security Center

Title: TorrentTrader Classic Multiple Remote Vulnerabilities

Severity: HIGH

Description:

TorrentTrader Classic is a PHP-based web application.

The application is prone to the following issues:

1. A weakness is present when generating random passwords. Specifically, random passwords are generated by taking the MD5 hash of a string representing a random number between 10000 and 50000. Attackers may exploit this issue to launch brute-force attacks against reset passwords. Note that knowledge of the email address associated with a specific account is enough to reset the password to a randomly generated value.

2. An information-disclosure vulnerability occurs because the application fails to restrict access to database backup files. Attackers may exploit this issue by requesting a backup through the 'backup-database.php' script. If the database name is known or can be guessed, the backup file may then be directly accessed through the 'backups' directory.

3. An information-disclosure vulnerability affects the 'check.php' script. Attackers may exploit this issue to obtain sensitive information about the vulnerable computer.

4. An SQL-injection vulnerability affects the 'origmsg' parameter of the 'account-inbox.php' script. To exploit this vulnerability, an attacker must authenticate as a valid user.

5. An SQL-injection vulnerability affects the 'wherecatin' parameter of the 'browse.php' script.

6. An SQL-injection vulnerability affects the 'categ' parameter of the 'delreq.php' script. To exploit this vulnerability, an attacker must authenticate as a valid user with 'super moderator' privileges.

7. An SQL-injection vulnerability affects the 'choice' parameter of the 'index.php' script. To exploit this vulnerability, an attacker must authenticate as a valid user. Note that at least one poll must exist before this vulnerability can be exploited.

8. An SQL-injection vulnerability affects the 'id' parameter of the 'modrules.php' script. To exploit this vulnerability, an attacker must authenticate as a valid user with 'moderator' privileges.

9. SQL-injection vulnerabilities affect the 'user', 'torrent', 'forumid', and 'forumpost' parameters of the 'report.php' script. To exploit these vulnerabilities, an attacker must authenticate as a valid user.

10. An SQL-injection vulnerability affects the 'delmp' parameter of the 'take-deletepm.php' script. To exploit this vulnerability, an attacker must authenticate as a valid user with 'admin' privileges.

11. An SQL-injection vulnerability affects the 'delreport' parameter of the 'takedelreport.php' script. To exploit this vulnerability, an attacker must authenticate as a valid user with 'moderator' privileges.

12. An SQL-injection vulnerability affects the 'delreq' parameter of the 'takedelreq.php' script. To exploit this vulnerability, an attacker must authenticate as a valid user.

13. An SQL-injection vulnerability affects the 'clases' parameter of the 'takestaffmess.php' script. To exploit this vulnerability, an attacker must authenticate as a valid user with 'admin' privileges.

14. An SQL-injection vulnerability affects the 'warndisable' parameter of the 'takewarndisable.php' script. To exploit this vulnerability, an attacker must authenticate as a valid user with 'moderator' privileges.

15. An SQL-injection vulnerability affects the 'limit' parameter of the 'today.php' script.

16. An SQL-injection vulnerability affects the 'where' parameter of the 'torrents-details.php' script.

17. An SQL-injection vulnerability affects the 'categ' parameter of the 'admin-delreq.php' script. To exploit this vulnerability, an attacker must authenticate as a valid user with 'moderator' privileges.

18. An HTML-injection vulnerability affects the 'Title' field of a torrent request submitted via the 'requests.php' script. Specifically, this data is later included in the page generated by the 'viewrequests.php' script. To exploit this vulnerability, an attacker must authenticate as a valid user.

19. An HTML-injection vulnerability affects the 'Torrent Name' field of a '.torrent' file uploaded via the 'torrent-upload.php' script. This data is later included in the page generated when the 'admin.php' script is called with the 'act' parameter set to 'view_log'. To exploit this vulnerability, an attacker must authenticate as a valid user.

20. A local-file-include vulnerability affects the 'ss_uri' parameter of the 'backend/admin-functions.php' script. This issue affects the application only when installed under Microsoft Windows.

21. Multiple cross-site scripting vulnerabilities affect the following scripts and parameters:

'themes/default/footer.php': 'ttversion'
'themes/default/header.php': 'SITENAME'
'themes/default/header.php': 'CURUSER[username]'
'visitorstoday.php': 'todayactive'
'visitorsnow.php': 'activepeople'
'faq.php': 'faq_categ[999][title]'
'torrents-details.php': 'keepget'

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, obtain sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database.

TorrentTrader Classic 1.09 is vulnerable; other versions may also be affected.

Affected Products:

  • TorrentTrader TorrentTrader Classic Edition 1.03
  • TorrentTrader TorrentTrader Classic Edition 1.04
  • TorrentTrader TorrentTrader Classic Edition 1.06
  • TorrentTrader TorrentTrader Classic Edition 1.07
  • TorrentTrader TorrentTrader Classic Edition 1.08
  • TorrentTrader TorrentTrader Classic Edition 1.09

References:

Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.