PT-2025-46214 · Unknown · Torrentpier

Xy20130630 · Publicado 2025-11-10 · Atualizado 2025-12-31 · CVE-2025-64519

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TorrentPier versions up to and including 2.8.8

Description TorrentPier, a BitTorrent Public/Private tracker engine, contains an authenticated SQL injection flaw in the moderator control panel, specifically within the modcp.php file. A user with moderator permissions can inject malicious SQL code through the topic id (t) parameter. This allows the execution of arbitrary SQL queries, potentially leading to data disclosure, modification, or deletion. The vulnerable code directly incorporates the topic id variable into an SQL query without proper sanitization. Exploitation requires moderator privileges and can be performed using tools like sqlmap. The vulnerability is a time-based blind SQL injection.

Recommendations Versions prior to 2.8.8 should be updated to a newer version that includes the patch available at commit 6a0f6499d89fa5d6e2afa8ee53802a1ad11ece80.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2025-64519

GHSA-4RWR-8C3M-55F6

Produtos afetados

Torrentpier

Referências · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64519.json · Exploit
• 🔥 https://github.com/torrentpier/torrentpier/security/advisories/GHSA-4rwr-8c3m-55f6 · Exploit
• https://github.com/torrentpier/torrentpier · Nota
• https://github.com/torrentpier/torrentpier/releases/tag/v2.8.9 · Nota
• https://github.com/torrentpier/torrentpier/commit/6a0f6499d89fa5d6e2afa8ee53802a1ad11ece80 · Correção
• https://t.me/cveNotify/147352 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-64519 · Aviso do Fabricante
• https://reddit.com/r/VulnMatter/comments/1ouaay3/resumen_diario_de_vulnerabilidades_11112025 · Publicação no Reddit
• https://reddit.com/r/VulnMatter/comments/1ow3bmx/resumen_diario_de_vulnerabilidades_13112025 · Publicação no Reddit
• https://t.me/CVEtracker/36958 · Publicação no Telegram
• https://twitter.com/CveTodo/status/1988025950810915261 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-64519 · Nota de Segurança
• https://reddit.com/r/VulnMatter/comments/1ov498g/resumen_diario_de_vulnerabilidades_12112025 · Publicação no Reddit
• https://twitter.com/CveFindCom/status/1988029097084166456 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1988012785217777893 · Publicação no Twitter