CVE-2012-2910

EPSS 1.7%

Multiple cross-site scripting (XSS) vulnerabilities in SiliSoftware phpThumb() 1.7.11 allow remote attackers to inject arbitrary web script or HTML via the (1) dir parameter to demo/phpThumb.demo.random.php or (2) title parameter to demo/phpThumb.demo.showpic.php.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencepacketstormsecurity.org/files/112797/SiliSoftware-phpThumb-1.7.11-Cross-Site-Scripting.htmlunverified exploitdbwww.exploit-db.com/exploits/37207unverified exploitdbwww.exploit-db.com/exploits/37206unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.org/files/112797/SiliSoftware-phpThumb-1.7.11-Cross-Site-Scripting.html https://exchange.xforce.ibmcloud.com/vulnerabilities/75709 http://www.securityfocus.com/bid/53572 http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5088.php