What is GHSA-3747-gjc9-vvg6?

GHSA-3747-gjc9-vvg6 is a security advisory published by GitHub Security Advisories with Medium severity. phpThumb is vulnerable to Server-Side Request Forgery (SSRF)

Which CVE IDs does GHSA-3747-gjc9-vvg6 cover?

GHSA-3747-gjc9-vvg6 covers the following CVE IDs: CVE-2013-6919. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-3747-gjc9-vvg6?

GHSA-3747-gjc9-vvg6 affects 1 product, including: composer/james-heinrich/phpthumb:\u003c 1.7.12.

GHSA-3747-gjc9-vvg6Medium

phpThumb is vulnerable to Server-Side Request Forgery (SSRF)

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

August 29, 2023

🔗 CVE IDs covered (1)

CVE-2013-6919 →

📋 Description

The default configuration of phpThumb before 1.7.12 has a false value for the disable_debug option, which allows remote attackers to conduct Server-Side Request Forgery (SSRF) attacks via the src parameter.

🎯 Affected products1

composer/james-heinrich/phpthumb:< 1.7.12

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2013-6919
http://www.rafayhackingarticles.net/2013/11/phpthumb-server-side-request-forgery.html
https://github.com/JamesHeinrich/phpThumb/commit/457a37d4a22ac9cdbbfe19577376622e58df81b0
https://github.com/JamesHeinrich/phpThumb/blob/7ee966b38ddd7eb4d8091389aa514604710711c8/docs/phpthumb.changelog.txt#L106
https://github.com/advisories/GHSA-3747-gjc9-vvg6