CVE-2006-1209

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-03-14 · updated 2026-06-16

Description

PHP Advanced Transfer Manager 1.00 through 1.30 stores sensitive information, including password hashes, under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for a users/[USERNAME] file.

Affected products

Bugada Andrea Php Advanced Transfer Manager: 1.00, 1.01, 1.02, 1.03, 1.20, 1.21 (+2)

References

http://biyosecurity.be/bugs/patm.txt
http://secunia.com/advisories/17134
http://securityreason.com/securityalert/565
http://www.blogcu.com/Liz0ziM/316652/
http://www.securityfocus.com/archive/1/427216/100/0/threaded
http://www.securityfocus.com/archive/1/437513/100/200/threaded
https://exchange.xforce.ibmcloud.com/vulnerabilities/25127
http://biyosecurity.be/bugs/patm.txt
http://secunia.com/advisories/17134
http://securityreason.com/securityalert/565
http://www.blogcu.com/Liz0ziM/316652/
http://www.securityfocus.com/archive/1/427216/100/0/threaded

Get alerted when CVE-2006-1209 or the next vulnerability affects your stack