Identified PHP/SQL leaks with roominfo.php

[Potatofactory]

roominfo.php is a great tool to find that theater is playing what and also to locate the history of a theater. However, It appears to be exploitable by simply entering a non-existing room or using the mecha theater.

User Agent:
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36

Sources

• Non-Existing Room: http://www.yukitheater.org/theater/roominfo.php?id=0
• Mecha Theater: http://www.yukitheater.org/theater/roominfo.php?id=0

Evidence

 

[WinterPhoenix]

Yep, I know. Doesn't really do anything, but it is something I should fix at some point. https://trello.com/c/bHLjTbQe/679-f...not-being-handled-well-in-the-server-overview