header-logo
Suggest Exploit
vendor:
PHP Advanced Transfer Manager
by:
5.5
CVSS
MEDIUM
Unauthorized Access
CWE
Product Name: PHP Advanced Transfer Manager
Affected Version From: 1.3
Affected Version To:
Patch Exists: NO
Related CWE:
CPE:
Metasploit:
Other Scripts:
Platforms Tested:

PHP Advanced Transfer Manager Unauthorized Access

Access to sensitive files containing authentication credentials is not restricted, allowing remote attackers to obtain a user's password hash and authenticate to the service using a cookie.

Mitigation:

Implement access restrictions to sensitive files and ensure proper authentication mechanisms are in place.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/15237/info

PHP Advanced Transfer Manager can allow remote attackers to gain unauthorized access.

Access to sensitive files containing authentication credentials is not restricted, therefore an attacker can simply issue a GET request to obtain a user's password hash. This information can then allow them to successfully authenticate to the service using a cookie.

PHP Advanced Transfer Manager 1.30 is reported to be vulnerable. Other versions may be affected as well. 

http://www.example.com/phpATM/users/<username>

Navigation

Suggest Exploit

Services By CQR