[wp-hackers] WordPress <= 2.8.5 Unrestricted File Upload Arbitrary PHP Code Execution
dave at technicacreative.co.uk
Wed Nov 11 19:55:06 UTC 2009
Defining it as a feature in one software and a bug in another. Smells
funny to me.
On 11 Nov 2009, at 19:53, Thomas Scholz wrote:
>> Well, that's kinda my point. I don't see it as a bug in WP. If you
>> upload a file named test.php.jpg, then WordPress is going to treat it
>> as a JPG file. It can't magically tell that the actual content of the
>> file is not a JPG.
> Sometimes it can. Mediawiki uses FileInfo or mime_content_type() to
> check uploaded files.
>> I don't think there's any bug to fix, as this is not a
>> WordPress-specific vulnerability. It's a generic vulnerability to any
>> software which allows you to upload files to a server and uses the
>> filename to differentiate between them.
> The point is not trust the suffix only.
>> The actual vulnerability is in Apache with the MultiViews option
> In Apache it’s a feature. The server doesn’t know if you want this
> Redaktion, Druck- und Webdesign
> http://toscho.de · 0160/1764727
> Twitter: @toscho
> wp-hackers mailing list
> wp-hackers at lists.automattic.com
More information about the wp-hackers