<<< Date Index >>>     <<< Thread Index >>>

Re: how to trick most of cms avatar upload filter [exemple for : RunCms (PoC)]



Hi,

securfrog@xxxxxxxxx kirjoitti:
then you need to take a good file editor , like: notepad++ (you can take whatever picture , and edit it without destroying it .) we need to put some php code AFTER the picture code . when it's done , try the picture if it still work , if yes , we are ok :).

This actually seems to work. A quick workaround is to disable PHP in the
directory where the avatar images are stored (or any user-uploaded files
for that matter) in Apache:

<Directory "/var/www/html/forum/avatardir">
  php_admin_flag engine off
</Directory>

--
  Taneli Leppä         | Crasman Co Ltd
  <taneli@xxxxxxxxxx>  | <http://www.crasman.fi/>