PT-2014-3216 · Phpthumb · Phpthumb

Deepankar Arora + 1 · Publicado 2014-12-27 · Atualizado 2022-05-17 · CVE-2013-6919

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpThumb versions prior to 1.7.12

Description The issue concerns the default configuration of phpThumb, where the disable debug option is set to false, allowing remote attackers to conduct Server-Side Request Forgery (SSRF) attacks. This is achieved by exploiting the src parameter.

Recommendations For versions prior to 1.7.12, update to version 1.7.12 or later to resolve the issue. As a temporary workaround, consider setting the disable debug option to true to prevent SSRF attacks via the src parameter.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2013-6919

GHSA-3747-GJC9-VVG6

Produtos afetados

Phpthumb

Referências · 7

• 🔥 http://rafayhackingarticles.net/2013/11/phpthumb-server-side-request-forgery.html · Exploit
• https://github.com/JamesHeinrich/phpThumb · Nota
• https://github.com/JamesHeinrich/phpThumb/commit/457a37d4a22ac9cdbbfe19577376622e58df81b0 · Nota
• https://github.com/JamesHeinrich/phpThumb/blob/7ee966b38ddd7eb4d8091389aa514604710711c8/docs/phpthumb.changelog.txt#L106 · Nota
• https://github.com/JamesHeinrich/phpThumb/blob/master/docs/phpthumb.changelog.txt · Nota
• https://osv.dev/vulnerability/GHSA-3747-gjc9-vvg6 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-6919 · Nota de Segurança