CVE-2009-5142

MEDIUM 4.3CVE-2009-5142 · Published 21/08/2014 · updated 16/06/2026

Package	Affected versions	Patched versions
timthumb binarymoon	`≤ 1.09`	No fix yet
mimbo pro prothemedesign	`= 2.3.1`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the src parameter.

References

packetstormsecurity.com/files/127724/WordPress-Gamespeed-Theme-Cross-Site-Scripting.html · Exploit
osvdb.org/71878
code.google.com/p/timthumb/issues/detail · Exploit
code.google.com/p/timthumb/source/detail · Patch

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free