search

meghlal / timthumb

Automatically exported from code.google.com/p/timthumb
0 stars 0 forks source link

0-day vulnerability in latest version #214

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago 
Hello,

I have been able to find a vulnerability in the latest version in timthumb.php 
which can allow arbitrary file creation, including PHP files, at any location 
in the file system that is writeable by the user PHP is running under.

Due to the sensitivity of this bug I will not post it publicly here, please 
email me at alexgt20052000 [AT] hotmail [DOT] com and I will give you further 
details from there. I have a working PoC I can show you to demonstrate the 
problem as well as a patch to fix the issue.

Thanks,
Alex Jeffrey

Original issue reported on code.google.com by alexgt20...@hotmail.com on 2 Aug 2011 at 1:31

GoogleCodeExporter commented 9 years ago 
also, just to clarify, this vulnerability is different from the one listed 
above this in the issue tracker.

Original comment by alexgt20...@hotmail.com on 2 Aug 2011 at 1:33

GoogleCodeExporter commented 9 years ago 
Hey Alex - I have contacted you via email. Thanks for bringing this to my 
attention!

Original comment by BinaryMoon on 2 Aug 2011 at 2:20

GoogleCodeExporter commented 9 years ago

Original comment by BinaryMoon on 2 Aug 2011 at 3:31