phpThumb() v1.7.11 (dir & title) Cross-Site Scripting Vulnerability


Vendor: SiliSoftware
Product web page: http://www.silisoftware.com
Affected version: 1.7.11-201108081537

Summary: phpThumb() uses the GD library to create thumbnails from
images (JPEG, PNG, GIF, BMP, etc) on the fly. The output size is
configurable (can be larger or smaller than the source), and the
source may be the entire image or only a portion of the original
image.

Desc: phpThumb is prone to a cross-site scripting vulnerability.
This issue is due to a failure in the application to properly
sanitize user-supplied input to the 'dir' and the 'title' parameter
of the 'phpThumb.demo.random.php' and 'phpThumb.demo.showpic.php'
scripts. Attackers can exploit this weakness to execute arbitrary
HTML and script code in a user's browser session.

Tested on: Microsoft Windows XP Professional SP3 (EN)
           Apache 2.2.21
           PHP 5.3.8
           MySQL 5.5.20


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2012-5088
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5088.php



15.05.2012

--

GET [SOME_CMS]/phpthumb/demo/phpThumb.demo.random.php?dir="><script>alert(document.cookie);</script> HTTP/1.1
GET [SOME_CMS]/phpthumb/demo/phpThumb.demo.showpic.php?title="><script>alert(document.cookie);</script> HTTP/1.1