Ali Raheem

**Name of the Vulnerable Software and Affected Versions** RivetTracker versions 1.03 and earlier **Description** The issue is related to the torrent functions.php file, which does not properly restrict access. This allows remote attackers to have an unspecified impact. **Recommendations** For RivetTracker versions 1.03 and earlier, consider restricting access to the torrent functions.php file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** RivetTracker versions 1.03 and earlier **Description** The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the `hash` parameter to specific API endpoints, such as "dltorrent.php" or "torrent functions.php". **Recommendations** For RivetTracker versions 1.03 and earlier, consider restricting access to the "dltorrent.php" and "torrent functions.php" endpoints until a patch is available. Avoid using the `hash` parameter in these endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.