Re: PHP Advanced Transfer Manager v1.20 ; Multiple Remote File Include Vulnerabilities

["Steven M. Christey" <coley () mitre org>]

l0x3 () hotmail com,

There have been many vulnerability reports like this, and they don't
seem to make sense.

You are the first one to say that you actually tested it, and it
worked.  Because you called it 'weird', you also clearly understand
that this does not make sense.

Maybe it's a bug in a very specific version or distribution of PHP.
If so, then it is a very serious bug.  But clearly, it is not in most
distributions of PHP, because many people can not reproduce it.

So, that's why it is important for you to tell us the PHP version, the
web server and version, operating system (maybe even hardware), and
all output from phpinfo().  If there's really a problem, it could be
anywhere.


Thank you,
Steve

P.S. my personal bet is a concurrency/threading error when there are a
few simultaneously loaded modules on a 64-bit multi-processor machine
and only supporting certain non-English languages.  *if* there's
really a problem :)