PHP 4.0 Bug #8123: PHP script extension Problem

From: younggon@hotmail.com Operating system: All PHP version: 4.0.3pl1 PHP Bug Type: Unknown/Other Function Bug description: PHP script extension Problem PHP script extension Problem Vulnerable : Under PHP 4.0.3pl1 httpd.conf ======================================================= AddType application/x-httpd-php .php ======================================================= ======================================================= cat > "phpbug1.php" << __EOF__ <? phpinfo(); ?> __EOF__ ======================================================= Generally, Apache refers to httpd.conf and recognizes the extension of "phpbug1.php" as an extension of PHP script. ======================================================= cat > "phpbug2.php " << __EOF__ <? phpinfo(); ?> __EOF__ ======================================================= In case of "phpbug2.php " script, it is treated as text strings since it is recognized as "phpbug2.php%20". *** Problem ======================================================= cat > "phpbug3.php." << __EOF__ <? phpinfo(); ?> __EOF__ ======================================================= cat > "phpbug4.php......." << __EOF__ <? phpinfo(); ?> __EOF__ ======================================================= "phpbug3.php." has to be treated as normal text strings since it's got no extension. However, PHP engine recognizes "phpbug3.php." as a PHP script and excutes it. PHP engine executes "phpbug4.php......." as a php script too. ========================================================= By: Young Gon Kim <younggon@hotmail.com> 12/5/2000 http://www.khdp.org/ http://drill.hackerslab.org/~piranha/ ========================================================= -- Edit Bug report at: http://bugs.php.net/?id=8123&edit=1