SQL Injection Affecting torrentpier/torrentpier package, versions >=0.0.0
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-TORRENTPIERTORRENTPIER-13876493
- published11 Nov 2025
- disclosed10 Nov 2025
- creditXY20130630
Introduced: 10 Nov 2025
NewCVE-2025-64519 (opens in a new tab)How to fix?
A fix was pushed into the master branch but not yet published.
Overview
torrentpier/torrentpier is a bull-powered BitTorrent tracker engine.
Affected versions of this package are vulnerable to SQL Injection via the validate_mode_condition function in the modcp.php file when handling the topic_id parameter. An attacker can execute arbitrary SQL queries by supplying crafted input as an authenticated moderator, potentially leading to disclosure, modification, or deletion of database data.
Note: This is only exploitable if the attacker has moderator privileges.