Re: Apache's PHP handlers

Hi Arno, it has nothing to do with ".php" in the file name. What the hacker did, was uploading a .gif file with some malicious php code included to your webserver. Then he called the .gif file from his own website by using a php script containing some code like require_once('http://www.yoursite.com/images/yourimage.gif'). At that moment the php code inside the .gif file has been executed. Steven ----- Original Message ----- From: "Arno Kuhl" <arno@dotcontent.net> To: "'Design in Motion Webdesign'" <info@designinmotion.be>; <php-general@lists.php.net> Sent: Thursday, September 19, 2013 2:43 PM Subject: RE: [PHP] Apache's PHP handlers

For the past week I've been trying to get to the bottom of an exploit, but googling hasn't been much help so far, nor has my service provider. Basically a file was uploaded with the filename xxx.php.pgif which

contained

nasty php code, and then the file was run directly from a browser. The upload script used to upload this file checks that the upload filename doesn't have a .php extension, which in this case it doesn't, so let it through. I was under the impression apache would serve any file with an extension not listed in its handlers directly back to the browser, but instead it sent it to the php handler. Is this normal behaviour or is

there

a problem with my service provider's apache configuration? Trying this on my localhost returns the file contents directly to the browser as expected

and doesn't run the php code.

-- Arno, the php file hidden as a gif will indeed not execute if opened directly from your website. But if opened from a page hosted elsewhere with some code like require($path_to_your_image), the php code inside the image will be sent to the php handler and will be executed. Prevention is the best way to avoid hacking from image upload. Check the file extention and the file content before upload. Cheers. Steven -- Hi Steven, I agree the best way to avoid this is for the file upload script to check the file contents and that's something I'll have to sort out, currently it just checks the extension. But it's still a concern that a file with any arbitrary extension can be processed as php script as long as it has the text ".php" in the filename. I'm not worried about including the file because that would require pre-existing malicious php code, I want to prevent that malicious php code from running in the first place. Cheers Arno -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php