CVE-2011-4106

This exploit leverages a vulnerability in WordPress TimThumb plugin (versions up to 1.32) to achieve remote code execution by tricking the script into caching a malicious PHP file disguised as a GIF image. The PoC includes a crafted GIF header followed by PHP code that executes arbitrary commands via the 'cmd' GET parameter.

This exploit demonstrates a remote code execution (RCE) vulnerability in multiple WordPress plugins due to the reuse of a vulnerable version of timthumb.php. The attack involves hosting a malicious GIF file with embedded PHP code and providing it via the 'src' GET parameter to upload and execute arbitrary code on the webserver.