Description

Multiple vendor applications utilize phpThumb(). phpThumb() uses the GD library to create thumbnails from images (JPEG, PNG, GIF, BMP, etc) on the fly. phpThumb() versions 1.7.9 and below are vulnerable to a command injection vulnerability that allows an attacker to execute arbitrary shell commands. To test this vulnerability, Acunetix created a file named cache/acunetix.

Remediation

Upgrade to the latest version of phpThumb.

References

phpThumb() Homepage

phpThumb() 'fltr[]' Parameter Command Injection Vulnerability

Related Vulnerabilities

XWiki Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2023-29518)

MySQL CVE-2021-2042 Vulnerability (CVE-2021-2042)

MySQL CVE-2020-2686 Vulnerability (CVE-2020-2686)

MongoDb Missing Authorization Vulnerability (CVE-2024-6375)

XWiki Cleartext Storage of Sensitive Information Vulnerability (CVE-2023-50719)

Severity

High

Classification

CVE-2010-1598 CWE-20 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Code Execution Known Vulnerabilities