CVE-2006-1209 | BDVDB-2026-15669 Detail
Description#
PHP Advanced Transfer Manager 1.00 through 1.30 stores sensitive information, including password hashes, under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for a users/[USERNAME] file.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- http://www.blogcu.com/Liz0ziM/316652/
- http://www.securityfocus.com/archive/1/427216/100/0/threaded
- http://biyosecurity.be/bugs/patm.txt
- http://www.securityfocus.com/archive/1/437513/100/200/threaded
- http://securityreason.com/securityalert/565
- http://secunia.com/advisories/17134
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25127
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.