CVE-2013-6919
phpthumb < 1.7.12 - Server-Side Request Forgery via src Parameter
Title source: llmDescription
The default configuration of phpThumb before 1.7.12 has a false value for the disable_debug option, which allows remote attackers to conduct Server-Side Request Forgery (SSRF) attacks via the src parameter.
References (2)
Core 2
Core References
Various Sources x_refsource_confirm
https://github.com/JamesHeinrich/phpThumb/blob/master/docs/phpthumb.changelog.txt
Exploit x_refsource_misc
http://www.rafayhackingarticles.net/2013/11/phpthumb-server-side-request-forgery.html
Scores
EPSS
0.0119
EPSS Percentile
64.1%
Details
Status
published
Products (2)
james-heinrich/phpthumb
0 - 1.7.12Packagist
phpthumb_project/phpthumb
< 1.7.11
Published
Dec 27, 2014
Tracked Since
Feb 18, 2026