CVE-2025-64519: TorrentPier Authenticated SQL Injection Vulnerability in Moderator Control Panel
Summary
CVE-2025-64519: An authenticated SQL injection vulnerability exists in the moderator control panel (modcp.php). Affects torrentpier/torrentpier versions < 2.8.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TorrentPier is an open-source forum software that enables users to create and manage online discussion boards. It provides features such as topic management, user moderation, and customizable forum settings. However, it has a critical vulnerability that allows authenticated users with moderator permissions to execute arbitrary SQL queries through the Moderator Control Panel, specifically via the 'topic_id' parameter.
Vulnerability Detail
An authenticated SQL injection vulnerability exists in the moderator control panel (modcp.php). Users with moderator permissions can exploit this vulnerability by supplying a malicious topic_id (t) parameter. The vulnerability arises because the topic_id is directly embedded into an SQL query without proper sanitization or parameterization. This allows attackers to manipulate the SQL query, potentially leading to unauthorized data disclosure, modification, or deletion.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict access to the Moderator Control Panel for users who do not need moderator permissions. Additionally, implement input validation to sanitize the topic_id parameter before processing it in SQL queries.
Conclusion
The CVE-2025-64519 vulnerability in TorrentPier poses a significant risk to users with moderator permissions, allowing them to execute arbitrary SQL queries. It is crucial to update to the latest version and implement proper input validation to mitigate this risk.
See every vulnerability recorded for torrentpier/torrentpier →
FAQ
CVE-2025-64519 is a vulnerability in TorrentPier that allows authenticated moderators to perform SQL injection attacks through the Moderator Control Panel.
Any instance of TorrentPier running versions up to 2.8.8 is affected, specifically if it allows users with moderator permissions.
The vulnerability can lead to unauthorized access to sensitive data, modification of database records, and deletion of critical forum data.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
The CVSS score for this vulnerability is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for torrentpier/torrentpier.
