PT-2025-46214 · Unknown · Torrentpier

Xy20130630 · Published 2025-11-10 · Updated 2025-12-31 · CVE-2025-64519

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TorrentPier versions up to and including 2.8.8

Description TorrentPier, a BitTorrent Public/Private tracker engine, contains an authenticated SQL injection flaw in the moderator control panel, specifically within the modcp.php file. A user with moderator permissions can inject malicious SQL code through the topic id (t) parameter. This allows the execution of arbitrary SQL queries, potentially leading to data disclosure, modification, or deletion. The vulnerable code directly incorporates the topic id variable into an SQL query without proper sanitization. Exploitation requires moderator privileges and can be performed using tools like sqlmap. The vulnerability is a time-based blind SQL injection.

Recommendations Versions prior to 2.8.8 should be updated to a newer version that includes the patch available at commit 6a0f6499d89fa5d6e2afa8ee53802a1ad11ece80.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-64519

GHSA-4RWR-8C3M-55F6

Affected Products

Torrentpier

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64519.json · Exploit
• 🔥 https://github.com/torrentpier/torrentpier/security/advisories/GHSA-4rwr-8c3m-55f6 · Exploit
• https://github.com/torrentpier/torrentpier/commit/6a0f6499d89fa5d6e2afa8ee53802a1ad11ece80 · Patch
• https://osv.dev/vulnerability/CVE-2025-64519 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64519 · Security Note
• https://osv.dev/vulnerability/GHSA-4rwr-8c3m-55f6 · Vendor Advisory
• https://github.com/torrentpier/torrentpier · Note
• https://github.com/torrentpier/torrentpier/releases/tag/v2.8.9 · Note
• https://t.me/cveNotify/147352 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1ouaay3/resumen_diario_de_vulnerabilidades_11112025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1ow3bmx/resumen_diario_de_vulnerabilidades_13112025 · Reddit Post
• https://t.me/CVEtracker/36958 · Telegram Post
• https://twitter.com/CveTodo/status/1988025950810915261 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1ov498g/resumen_diario_de_vulnerabilidades_12112025 · Reddit Post
• https://twitter.com/CveFindCom/status/1988029097084166456 · Twitter Post