BugTraq
how to trick most of cms avatar upload filter [exemple for : RunCms (PoC)] Nov 02 2006 06:30AM
securfrog gmail com (2 replies)
Re: how to trick most of cms avatar upload filter [exemple for : RunCms (PoC)] Nov 03 2006 11:45PM
Paul Laudanski (paul castlecops com)
Re: how to trick most of cms avatar upload filter [exemple for : RunCms (PoC)] Nov 02 2006 07:56PM
Taneli Leppä (taneli crasman fi)
Hi,

securfrog (at) gmail (dot) com [email concealed] kirjoitti:
> then you need to take a good file editor , like: notepad++
> (you can take whatever picture , and edit it without destroying it .)
> we need to put some php code AFTER the picture code .
> when it's done , try the picture if it still work , if yes , we are ok :).

This actually seems to work. A quick workaround is to disable PHP in the
directory where the avatar images are stored (or any user-uploaded files
for that matter) in Apache:

<Directory "/var/www/html/forum/avatardir">
php_admin_flag engine off
</Directory>

--
Taneli Leppä | Crasman Co Ltd
<taneli (at) crasman (dot) fi [email concealed]> | <http://www.crasman.fi/>

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus