PHP Advanced Transfer Manager contains a flaw that may allow a malicious user to include arbitrary HTML content from remote sites. The issue is triggered when an attacker requests the html.php script but supplies remote HTML content to the 'current_dir' variable. It is possible that the flaw may allow a remote user to manipulate site content.
Classification
Location:
Remote / Network Access
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Exploit:
Exploit Public
OSVDB:
Web Related
Solution
Currently, there are no known upgrades, patches, or workarounds available to correct this issue.
