Re: [RFC] Script only include/require
| From: | Dan Ackroyd | Date: | Wed, 25 Feb 2015 00:38:54 +0000 |
| Subject: | Re: [RFC] Script only include/require | ||
| References: | 1 2 3 4 5 6 7 8 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-83723@lists.php.net to get a copy of this message | ||
On 25 February 2015 at 00:09, Pádraic Brady <padraic.brady@gmail.com> wrote:
>
> Your example omitted the image validation step which would have
> noticed your attempt to upload a phar immediately. Add that and try
> again.
Image validation is no defense against this type of attack:
http://php.webtutor.pl/en/2011/05/13/php-code-injection-a-simple-virus-written-in-php-and-carried-in-a-jpeg-image/
As soon as you have any possibility of including a file uploaded by an
attacker, you are probably going to lose.
cheers
Dan