Bug #69002 [Opn->Nab]: Possible to bypass getimagesize

Edit report at https://bugs.php.net/bug.php?id=69002&edit=1 ID: 69002 Updated by: requinix@php.net Reported by: king4aol at gmail dot com Summary: Possible to bypass getimagesize -Status: Open +Status: Not a bug Type: Bug Package: GetImageSize related Operating System: Any PHP Version: Irrelevant Block user comment: N Private report: N New Comment: Sorry, but your problem does not imply a bug in PHP itself. For a list of more appropriate places to ask for help using PHP, please visit http://www.php.net/support.php as this bug system is not the appropriate forum for asking support questions. Due to the volume of reports we can not explain in detail here why your report is not a bug. The support channels will be able to provide an explanation for you. Thank you for your interest in PHP. getimagesize() merely provides information about an image. It does not, nor does it claim to, perform anything resembling validation beyond what is strictly required to derive the information it seeks. Anyone relying on it for complete validation of a file is abusing it at their own risk. Previous Comments: ------------------------------------------------------------------------ [2015-02-07 07:53:23] king4aol at gmail dot com Description: ------------ According To Documentation " The getimagesize() function will determine the size of any given image file and return the dimensions along with the file type and a height/width text string to be used inside a normal HTML IMG tag and the correspondant HTTP content type. " Many developers just relay on this function while uploading images. As it is stated that it will also provide content type. And just check extension at client side. But it is very easy to bypass this function and execute commands. Test script: --------------- For the test purpose i use gifsicle utility for adding comments into a GIF. Command "gifsicle -c '<?php ?>'" anygif.gif > phpgif.gif" Then while uploading change extension to .php with burpsuite or any other and you had successfully uploaded your shell. getimagesize won't check file extension that's why many websites are vulnerable due to some noob developers and failure of this function. I am reporting this to you after compromising security of many websites and i had help them to secure their system. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=69002&edit=1