Re: Interesting article about PHP security exploit by GIF files
| From: | Dan | Date: | Thu, 21 Jun 2007 17:45:49 +0000 |
| Subject: | Re: Interesting article about PHP security exploit by GIF files | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-257573@lists.php.net to get a copy of this message | ||
What's with all this checking of mime types, etc? As long as you check that it doesn't have .php at the end of it's filename then you're fine. Unless you have PHP set to run on every filetype or something strange. Isn't it obvious not to allow anything.anything.php as an upload?
- Dan
"Tijnema" <tijnema@gmail.com> wrote in message news:d8269d910706200854u61d85da8oc9f04f3fc6b7d59@mail.gmail.com...
Hi all, Just received a mail from phpclasses, which pointed to this very interesting article[1]. Seems good to know for starters ;) The experts around here probably already know this way of exploits. Tijnema [1] http://www.phpclasses.org/blog/post/67-PHP-security-exploit-with-GIF-images.html