PT-2014-3216 · Phpthumb · Phpthumb

Deepankar Arora + 1 · Published 2014-12-27 · Updated 2022-05-17 · CVE-2013-6919

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpThumb versions prior to 1.7.12

Description The issue concerns the default configuration of phpThumb, where the disable debug option is set to false, allowing remote attackers to conduct Server-Side Request Forgery (SSRF) attacks. This is achieved by exploiting the src parameter.

Recommendations For versions prior to 1.7.12, update to version 1.7.12 or later to resolve the issue. As a temporary workaround, consider setting the disable debug option to true to prevent SSRF attacks via the src parameter.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2013-6919

GHSA-3747-GJC9-VVG6

Affected Products

Phpthumb

References · 7

• 🔥 http://rafayhackingarticles.net/2013/11/phpthumb-server-side-request-forgery.html · Exploit
• https://osv.dev/vulnerability/GHSA-3747-gjc9-vvg6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6919 · Security Note
• https://github.com/JamesHeinrich/phpThumb · Note
• https://github.com/JamesHeinrich/phpThumb/commit/457a37d4a22ac9cdbbfe19577376622e58df81b0 · Note
• https://github.com/JamesHeinrich/phpThumb/blob/7ee966b38ddd7eb4d8091389aa514604710711c8/docs/phpthumb.changelog.txt#L106 · Note
• https://github.com/JamesHeinrich/phpThumb/blob/master/docs/phpthumb.changelog.txt · Note