Unscored CVE-2006-1207 EUVD-2006-1211GHSA-grh8-q9mh-3qv7

PHP Upload Center stores password hashes under the web root with insufficient access control, which allows remote attackers to download eac…

Published Mar 14, 2006 · Updated Aug 7, 2024 · Assigned by mitre

Description

PHP Upload Center stores password hashes under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for the upload/users/[USERNAME] file.

References

http://www.blogcu.com/Liz0ziM/317250/
20060309 PHP Upload Center Download users password hashes And phpshell Upload mailing-list
http://biyosecurity.be/bugs/phpuploadcenter2.txt
23627 vdb-entry
http://www.scripts-by.net/PHP/File-Manipulation/php-upload-center.html