Timthumb security flaw

(3 posts) (3 voices)

Tags:

blogmeistress
Member

Hi there

I've been reading recently about the security flaw in TimThumb (article here) - and was wanting to update the timthumb file in the Big Feature theme to make sure this doesn't happen to my clients sites. I use Big Feature often, so will need to do this across the board. I tried replacing the timthumb.php file with the new one provided by the creator (as suggested by Woo Themes in that article linked above), but it didn't work - the images were no longer showing. So, I have reverted for the time being, but need to get this updated as soon as I can.

Is there something specific I should be doing to update this for Big Feature?

Really appreciate your time.

Thanks!

Pia

Posted 1 year ago #
vfxdude
admin

updating timthumb.php (in library/timthumb) should work (zoom cropping will not work then though). You might have to delete the cache folder, and recreate it if it's not done automatically (I did not have to do this with my hosting, but setups are different).

timthumb is updated in the latest version of the theme (1.4.1).

Posted 1 year ago #
dubief
Member

I hope everybody has updated to the most current version of BigFeature! My itty bitty site just got hacked (BOOOO!) through timthumb because I hadn't upgraded to 1.4.1. Which was totally stupid on my part.

So yes this is a REAL vulnerability and yes you DO want to use the most current theme version to avoid the mess I just finished cleaning up. Blech.

Posted 1 year ago #

Reply

You must log in to post.