PT-2005-2583 · Php · Phpatm

Published 2005-05-16 · Updated 2018-10-19 · CVE-2005-1604

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP Advanced Transfer Manager (phpATM) version 1.21

Description The issue allows remote attackers to upload arbitrary files, potentially leading to the execution of arbitrary PHP code. This can be achieved by using filenames that contain multiple file extensions.

Recommendations For PHP Advanced Transfer Manager (phpATM) version 1.21, consider restricting file uploads to only allow specific, trusted file extensions as a temporary workaround until a patch is available. Additionally, restrict access to the file upload functionality to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-1604

Affected Products

Phpatm

References · 9

• 🔥 http://securityfocus.com/bid/13542 · Exploit
• 🔥 http://seclists.org/lists/bugtraq/2005/May/0075.html · Exploit
• 🔥 https://exploit-db.com/exploits/25627 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-1604 · Security Note
• http://osvdb.org/16160 · Note
• http://secunia.com/advisories/15279 · Note
• http://securityfocus.com/archive/1/415172 · Note
• http://securityfocus.com/archive/1/415300/30/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1604 · Note