Taneli Leppä kirjoitti:
>> then you need to take a good file editor , like: notepad++ (you can
>> take whatever picture , and edit it without destroying it .)
>> we need to put some php code AFTER the picture code . when it's done
>> , try the picture if it still work , if yes , we are ok :).
> This actually seems to work. A quick workaround is to disable PHP in the
> directory where the avatar images are stored (or any user-uploaded files
> for that matter) in Apache:
>
> <Directory "/var/www/html/forum/avatardir">
> php_admin_flag engine off
> </Directory>
Actually, your exploit only works if the avatar system strips the
.jpg extension for some reason. Unless you have configured .jpg
as a valid extension to be executed through PHP. But the above
still stands as a valid precaution for user uploaded material.
--
Taneli Leppä | Crasman Co Ltd
<taneli (at) crasman (dot) fi [email concealed]> | <http://www.crasman.fi/>
>> then you need to take a good file editor , like: notepad++ (you can
>> take whatever picture , and edit it without destroying it .)
>> we need to put some php code AFTER the picture code . when it's done
>> , try the picture if it still work , if yes , we are ok :).
> This actually seems to work. A quick workaround is to disable PHP in the
> directory where the avatar images are stored (or any user-uploaded files
> for that matter) in Apache:
>
> <Directory "/var/www/html/forum/avatardir">
> php_admin_flag engine off
> </Directory>
Actually, your exploit only works if the avatar system strips the
.jpg extension for some reason. Unless you have configured .jpg
as a valid extension to be executed through PHP. But the above
still stands as a valid precaution for user uploaded material.
--
Taneli Leppä | Crasman Co Ltd
<taneli (at) crasman (dot) fi [email concealed]> | <http://www.crasman.fi/>
[ reply ]