Description

An image resizing utility named timthumb is widely used by many WordPress themes and plugins. Some versions of this utility contain a security vulnerability that allows hackers to upload and execute arbitrary PHP code in your timthumb cache directory. Acunetix identified that your blog contains a vulnerable version of this utility. It's recommended to immediately upgrade to the latest version.

Remediation

Upgrade to the latest version of timthumb.php. Version 1.34 is the first version that contains the fixed code.

References

TimThumb Remote Code Execution

timthumb

Related Vulnerabilities

Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-8152)

ownCloud Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-3834)

PHP Improper Input Validation Vulnerability (CVE-2015-4598)

ReviveAdserver Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-9126)

phpBB Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-5917)

Severity

High

Classification

CVE-2011-4106 CWE-20 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Code Execution Known Vulnerabilities