WordPress TimThumb Plugin Multiple Security Vulnerabilities

Bugtraq ID:	56953
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Dec 17 2012 12:00AM
Updated:	Dec 17 2012 12:00AM
Credit:	MustLive
Vulnerable:
Not Vulnerable:

WordPress TimThumb Plugin Multiple Security Vulnerabilities

The TimThumb plug-in for WordPress is prone to multiple security vulnerabilities, including:

1. A cross-site scripting vulnerability
2. Multiple security-bypass vulnerabilities
3. An arbitrary file-upload vulnerability
4. An information-disclosure vulnerability
5. Multiple path-disclosure vulnerabilities
6. A denial-of-service vulnerability

Attackers can exploit these issues to bypass certain security restrictions, obtain sensitive information, perform certain administrative actions, gain unauthorized access, upload arbitrary files, compromise the application, access or modify data, cause denial-of-service conditions, steal cookie-based authentication credentials, or control how the site is rendered to the user; other attacks may also be possible.

WordPress TimThumb Plugin Multiple Security Vulnerabilities

The following example URIs and input data are available:

• /data/vulnerabilities/exploits/56953.txt

WordPress TimThumb Plugin Multiple Security Vulnerabilities

References:

• Multiple vulnerabilities in RokBox for WordPress (MustLive)
  
• RokBox Homepage (Rockettheme)