PhpThumb.php SSRF/LFI

I initially found this issue on a bounty, however it was marked out of scope on a third party provider. It may be possible to turn this into a RCE. Since I had no reason to escalate since no payment. I’ll leave that up to whoever wants to find out.

Google Dork: inurl:/phpThumb/phpThumb.php?src=

Payload: phpThumb.php?src=file:///etc/passwd


You will see in the response “Unknown image type identified by “root”. It’s reading the /etc/passwd file! However since it only displays the first four characters in the error we can’t read the whole file.

You can also tell it to load remote files



PhpThumb.php SSRF/LFI

XSS via Loading Remote SVG


This XSS was via embedly which controls the content-type response to image types. Luckily .svg was allowed.

I used this blog to help create a .svg that contained XSS.



<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "">

<svg version="1.1" baseProfile="full" xmlns="">
   <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
XSS via Loading Remote SVG