VulnerabilityModified
CVE-2006-1209
PHP Advanced Transfer Manager 1.00 through 1.30 stores sensitive information, including password hashes, under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for a…
MEDIUM 5.0EPSS 3.39%
Does this matter?
Lower severity and a low EPSS score (3.39%). Track it; it rarely justifies an emergency change on its own.
Description
PHP Advanced Transfer Manager 1.00 through 1.30 stores sensitive information, including password hashes, under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for a users/[USERNAME] file.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 3.39% probability · 88th percentile
- CISA KEV
- Not listed
- Affected
- bugada andrea/php advanced transfer manager
- Source
- cve@mitre.org
References
- http://biyosecurity.be/bugs/patm.txtExploit
- http://secunia.com/advisories/17134
- http://securityreason.com/securityalert/565
- http://www.blogcu.com/Liz0ziM/316652/Exploit, URL Repurposed
- http://www.securityfocus.com/archive/1/427216/100/0/threaded
- http://www.securityfocus.com/archive/1/437513/100/200/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25127
- http://biyosecurity.be/bugs/patm.txtExploit
- http://secunia.com/advisories/17134
- http://securityreason.com/securityalert/565
- http://www.blogcu.com/Liz0ziM/316652/Exploit, URL Repurposed
- http://www.securityfocus.com/archive/1/427216/100/0/threaded
- http://www.securityfocus.com/archive/1/437513/100/200/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25127
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.