CVE-2006-4594

Affected product/versions: PHP Advanced Transfer Manager (phpATM) 1.21 and earlier. Vulnerability: Multiple remote PHP file inclusion via the include_location parameter in (1) confirm.php and (2) login.php, allowing remote code execution. The index.php vector is already covered by CVE-2005-1681. ...

CVE-2005-1681

CVE-2005-1681 affects phpATM 1.21 (and possibly earlier) where a PHP remote file inclusion flaw in common.php allows an attacker to execute arbitrary PHP code via a URL in the include_location parameter to index.php. The vulnerability (root cause: include_location-driven RFI in index.php) enables...

CVE-2006-4749

CVE-2006-4749 describes multiple PHP remote file inclusion vulnerabilities in PHP Advanced Transfer Manager (phpATM) 1.20 and earlier. The flaw allows remote attackers to execute arbitrary PHP code via the include_location parameter in files including activate.php, configure.php, fileop.php, geti...

CVE-2005-2998

CVE-2005-2998 affects PHP Advanced Transfer Manager 1.30. The vulnerability involves a default administrator password that allows remote attackers to upload and execute arbitrary PHP files. Impact is described overall as partial confidentiality, integrity, and availability. No explicit remediatio...

CVE-2005-1604

CVE-2005-1604 affects PHP Advanced Transfer Manager (phpATM) 1.21. The vulnerability allows remote attackers to upload arbitrary files by crafting a filename with multiple extensions (e.g., ending in php.ns), enabling execution of arbitrary PHP code on the server. Connected sources corroborate a ...