CVE-2006-1209

Published: Mar 14, 2006Modified: Apr 16, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

PHP Advanced Transfer Manager 1.00 through 1.30 stores sensitive information, including password hashes, under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for a users/[USERNAME] file.

Affected (8)

Products: Bugada Andrea: Php Advanced Transfer Manager

Bugada Andrea

1 product

Php Advanced Transfer Manager

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Bugada Andrea Php Advanced Transfer Manager	Version 1.00
Bugada Andrea Php Advanced Transfer Manager	Version 1.01
Bugada Andrea Php Advanced Transfer Manager	Version 1.02
Bugada Andrea Php Advanced Transfer Manager	Version 1.03
Bugada Andrea Php Advanced Transfer Manager	Version 1.20
Bugada Andrea Php Advanced Transfer Manager	Version 1.21
Bugada Andrea Php Advanced Transfer Manager	Version 1.22
Bugada Andrea Php Advanced Transfer Manager	Version 1.30