Signature Detail

HTTP: PHP With GIF Header Evasion Command Execution

This signature detects PHP files with GIF image headers. WordPress blogs which use the "TimThumb" graphics manipulation library are vulnerable to PHP command execution when such files are passed to them for processing. This vulnerability is being actively exploited by BotNets as of June 2012.

References

• URL: http://www.emergingthreatspro.com/bot-of-the-day/under-my-timthumbs-thumb/
• URL: http://code.google.com/p/timthumb/
• URL: http://wordpress.org/
• URL: http://blog.sucuri.net/2012/05/list-of-domains-hosting-webshells-for-timthumb-attacks.html