Bugtraq mailing list archives
Re: how to trick most of cms avatar upload filter [exemple for : RunCms (PoC)]
From: Taneli Leppä <taneli () crasman fi>
Date: Thu, 02 Nov 2006 21:56:49 +0200
Hi, securfrog () gmail com kirjoitti:
then you need to take a good file editor , like: notepad++ (you can take whatever picture , and edit it without destroying it .) we need to put some php code AFTER the picture code . when it's done , try the picture if it still work , if yes , we are ok :).
This actually seems to work. A quick workaround is to disable PHP in the directory where the avatar images are stored (or any user-uploaded files for that matter) in Apache: <Directory "/var/www/html/forum/avatardir"> php_admin_flag engine off </Directory> -- Taneli Leppä | Crasman Co Ltd <taneli () crasman fi> | <http://www.crasman.fi/>
Current thread:
- how to trick most of cms avatar upload filter [exemple for : RunCms (PoC)] securfrog (Nov 02)
- Re: how to trick most of cms avatar upload filter [exemple for : RunCms (PoC)] Taneli Leppä (Nov 02)
- Re: how to trick most of cms avatar upload filter [exemple for : RunCms (PoC)] Taneli Leppä (Nov 02)
- RE: how to trick most of cms avatar upload filter [exemple for : RunCms (PoC)] Richard Stanway (Nov 02)
- Re: how to trick most of cms avatar upload filter [exemple for : RunCms (PoC)] Taneli Leppä (Nov 02)
- Re: how to trick most of cms avatar upload filter [exemple for : RunCms (PoC)] Paul Laudanski (Nov 04)
- Re: how to trick most of cms avatar upload filter [exemple for : RunCms (PoC)] Taneli Leppä (Nov 02)