What is CVE-2011-4106?

CVE-2011-4106 is a vulnerability in Binarymoon Timthumb, classified under Improper Input Validation. Published 2013-10-26.

Is CVE-2011-4106 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Improper input validation in Binarymoon Timthumb

CVE-2011-4106

TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter, then accessing it via a direct request to the file in the cache directory, as exploited in the wild in August 2011.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.116 (95.6th percentile) — read the EPSS interpretation.

Affected products

Binarymoon Timthumb
N/a — versions n/a

Weakness classification (CWE)

CWE-20 — Improper Input Validation

Public proof-of-concept exploits

20142995/nuclei-templates

References

secalert@redhat.com (Exploit, exploit, x_refsource_EXPLOIT-DB)
secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (Patch, x_refsource_MISC)
secalert@redhat.com (mailing-list, x_refsource_MLIST)
secalert@redhat.com (Exploit, exploit, x_refsource_EXPLOIT-DB)
secalert@redhat.com (x_refsource_CONFIRM, Exploit, Patch)
secalert@redhat.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2011-4106?: CVE-2011-4106 is a vulnerability in Binarymoon Timthumb, classified under Improper Input Validation. Published 2013-10-26.
Is CVE-2011-4106 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.