Friday 25 November 2011

Timthumb.php vulnerability in WordPress function

It is possible that for some days you shall have detected that your thumbnails (thumbails) of your WordPress site have stopped working.
This is because Mark Maunder discovered a vulnerability in the code in timthumb.php that allowed any hacker execute PHP code exploits vulnerabilities in the folder cache that uses the library timthumb.php




Many web hosts or servers dedicated to its users have reported the problem and also have disabled the timthumb.php (especially in hostings) by placing an exit, in the first line of code.
To resolve the vulnerability must comment or delete all the domains that are in the array $ allowedSites .
Also for safety and should disable the global variable ALLOW_EXTERNAL with FALSE being this:  define ('ALLOW_EXTERNAL', FALSE);

No comments:

Post a Comment