Re: Interesting article about PHP security exploit by GIF files

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Wed, 2007-06-20 at 15:12 -0400, Daniel Brown wrote:
> On 6/20/07, tedd <tedd@xxxxxxxxxxxx> wrote:
> > At 12:53 PM -0400 6/20/07, Daniel Brown wrote:
> > >
> > >    No, not the upload and execution, per se, but rather using images
> > >to contain processable PHP code.
> > >
> > >--
> > >Daniel P. Brown
> >
> >
> > Daniel:
> >
> > Wow! Now that's something I would like to see -- you do have a demo?
> >
> > As far as "legitimate reasons", how about image buttons that execute
> > code without having to tied them to "href=" statements. Like a "grab
> > this image for that function" sort of thing. I see lot's of
> > possibilities.

Except that as soon as the button is loaded by the browser you'll
trigger that functionality. I don't think it'll do what you want Ted :)

I'm going to be honest, I don't really see any good reason to
legitimately put PHP code in an image that can be loaded by the browser.
I can see using URL rewriting to rewrite a special image name to a PHP
script, but not using an image explicitly. If you use an image
explicitly then it means the PHP engine is loaded for every single image
request (unless you've only opened it up to certain directories
via .htaccess or whatnot).

Cheers,
Rob.
-- 
.------------------------------------------------------------.
| InterJinn Application Framework - http://www.interjinn.com |
:------------------------------------------------------------:
| An application and templating framework for PHP. Boasting  |
| a powerful, scalable system for accessing system services  |
| such as forms, properties, sessions, and caches. InterJinn |
| also provides an extremely flexible architecture for       |
| creating re-usable components quickly and easily.          |
`------------------------------------------------------------'

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux