Torrenttrader

Torrenttrader Classic

8 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
3.5

CVE-2009-2156

Exploit
  • EPSS 0.88%
  • Veröffentlicht 22.06.2009 19:30:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Multiple cross-site scripting (XSS) vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to inject arbitrary web script or HTML via (1) the Title field to requests.php, related to viewrequests.php; and (2) the Torrent Name f...

6.5

CVE-2009-2157

Exploit
  • EPSS 1.17%
  • Veröffentlicht 22.06.2009 19:30:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Multiple SQL injection vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to execute arbitrary SQL commands via (1) the origmsg parameter to account-inbox.php; the categ parameter to (2) delreq.php and (3) admin-delreq.php...

6.4

CVE-2009-2159

Exploit
  • EPSS 6.74%
  • Veröffentlicht 22.06.2009 19:30:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

backup-database.php in TorrentTrader Classic 1.09 does not require administrative authentication, which allows remote attackers to create and download a backup database by making a direct request and then retrieving a .gz file from backups/.

5

CVE-2009-2160

Exploit
  • EPSS 9.36%
  • Veröffentlicht 22.06.2009 19:30:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

TorrentTrader Classic 1.09 allows remote attackers to (1) obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function; and allows remote attackers to (2) obtain other potentially sensitive information via a ...

5.1

CVE-2009-2161

Exploit
  • EPSS 9.38%
  • Veröffentlicht 22.06.2009 19:30:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic 1.09, when used on a case-insensitive web site, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ss_uri parameter,...

6.8

CVE-2008-2428

  • EPSS 0.66%
  • Veröffentlicht 18.06.2008 19:41:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Multiple SQL injection vulnerabilities in TorrentTrader 1.08 Classic allow remote attackers to execute arbitrary SQL commands via the (1) email or (2) wantusername parameter to account-signup.php, or the (3) receiver parameter to account-inbox.php in...

4.3

CVE-2008-1172

  • EPSS 0.13%
  • Veröffentlicht 06.03.2008 00:44:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Cross-site request forgery (CSRF) vulnerabilities in account-inbox.php in TorrentTrader Classic 1.08 allow remote attackers to perform certain actions as other users, as demonstrated by sending messages.

4.3

CVE-2008-1173

  • EPSS 0.4%
  • Veröffentlicht 06.03.2008 00:44:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Cross-site scripting (XSS) vulnerability in account-inbox.php in TorrentTrader Classic 1.08 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.