A remote SQL injection vulnerability exists in WebTorrent (WTcom) Script version 0.2.4 and earlier. An attacker can exploit this vulnerability to gain access to every username, password and email stored in the database. The vulnerability is due to insufficient sanitization of user-supplied input to the 'cat' parameter in the 'torrents.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing malicious SQL statements to the vulnerable script.