Vulnerability Details CVE-2014-4663
TimThumb 2.8.13 and WordThumb 1.07, when Webshot (aka Webshots) is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the src parameter.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.239
EPSS Ranking 95.8%
CVSS Severity
CVSS v2 Score 6.8
References
- http://packetstormsecurity.com/files/127192/TimThumb-2.8.13-Remote-Code-Execution.html
- http://seclists.org/fulldisclosure/2014/Jul/4
- http://seclists.org/fulldisclosure/2014/Jun/117
- http://seclists.org/oss-sec/2014/q2/689
- http://secunia.com/advisories/59558
- http://www.exploit-db.com/exploits/33851
- https://code.google.com/p/timthumb/issues/detail?id=485
- https://code.google.com/p/timthumb/source/detail?r=219
- http://packetstormsecurity.com/files/127192/TimThumb-2.8.13-Remote-Code-Execution.html
- http://seclists.org/fulldisclosure/2014/Jul/4
- http://seclists.org/fulldisclosure/2014/Jun/117
- http://seclists.org/oss-sec/2014/q2/689
- http://secunia.com/advisories/59558
- http://www.exploit-db.com/exploits/33851
- https://code.google.com/p/timthumb/issues/detail?id=485
- https://code.google.com/p/timthumb/source/detail?r=219
Products affected by CVE-2014-4663
-
cpe:2.3:a:binarymoon:timthumb:2.8.13
-
cpe:2.3:a:binarymoon:wordthumb:1.07