CVE-2008-2428

TorrentTrader Classic 1.08 - SQL Injection via Email, Wantusername, or Receiver Parameter

Title source: llm

Description

Multiple SQL injection vulnerabilities in TorrentTrader 1.08 Classic allow remote attackers to execute arbitrary SQL commands via the (1) email or (2) wantusername parameter to account-signup.php, or the (3) receiver parameter to account-inbox.php in a msg action.

References (7)

Core 7

Core References

Various Sources x_refsource_misc

http://www.torrenttrader.org/index.php?showtopic=8879

Product x_refsource_confirm

http://sourceforge.net/project/shownotes.php?group_id=98584&release_id=545219

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/30565

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/29787

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/43165

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/493434/100/0/threaded

Vendor Advisory x_refsource_misc

http://secunia.com/secunia_research/2008-15/advisory/

Scores

EPSS 0.0122

EPSS Percentile 65.6%

Details

CWE

CWE-89

Status published

Products (1)

torrenttrader/torrenttrader_classic 1.08

Published Jun 18, 2008

Tracked Since Feb 18, 2026