TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic_id parameter

Vulnerability

An authenticated SQL injection vulnerability exists in the moderator control panel (modcp.php) of TorrentPier, an open-source BitTorrent tracker engine, in versions up to and including 2.8.8 [1]. The root cause is that the topic_id parameter (passed as t in the request) is taken directly from user input and concatenated into an SQL query without sanitization or parameterization [1]. Specifically, in the vulnerable code block at lines 111-122 of modcp.php, the variable $topic_id is embedded directly into the WHERE t.topic_id = $topic_id clause [1].

Exploitation

To exploit this vulnerability, an attacker must have moderator privileges on a TorrentPier instance [1]. The attacker can supply a malicious topic_id value containing SQL syntax (e.g., boolean logic or time-based functions) to manipulate the query's execution [1]. A proof-of-concept demonstrates using sqlmap with sqlmap to automate time-based blind SQL injection against the t parameter [1].

Impact

Successful exploitation allows an authenticated moderator to execute arbitrary SQL queries against the database [1]. This can lead to the disclosure, modification, or deletion of any data stored in the database, including user credentials, private messages, and tracker configuration [1]. The severity is high because a compromised or malicious moderator account can fully compromise the database [1].

Mitigation

The vulnerability is patched in commit 6a0f6499d89fa5d6e2afa8ee53802a1ad11ece80, which casts the topic_id value to an integer before use [4]. This fix is included in version 2.8.9, released on 2025-11-28 [3]. Users should upgrade to version 2.8.9 or later [3]. Note that the TorrentPier project has since been archived and no further security patches are planned; self-hosted instances are responsible for their own security maintenance [2].