CVE-2014-4663 Ajax Search Lite < 3.11 - Remote Code Execution
MediumCVSS 6.8
EPSS 9.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
TimThumb 2.8.13 and WordThumb 1.07, when Webshot (aka Webshots) is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the src parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| binarymoon timthumb | = 2.8.13 | No fix listed |
| binarymoon wordthumb | = 1.07 | No fix listed |
| wordpress ajax-search-lite(WordPress) | < 3.11 | 3.11 |
References
- packetstormsecurity.com
- 20140701 Re: Wordpress TimThumb 2.8.13 WebShot Remote Code Execution (0-day) mailing-list
- 20140624 Wordpress TimThumb 2.8.13 WebShot Remote Code Execution (0-day) mailing-list
- [oss-security] 20140627 Re: CVE request: timthumb remote code execution mailing-list
- 59558 third-party-advisory
- 33851 exploit
- code.google.com
- code.google.com
- Wordfence Intelligence third-party-advisory
- www.cve.org
- Wordfence Intelligence third-party-advisory