Re: WordPress 2.8.5 Unrestricted File Upload Arbitrary PHP Code Execution

[golunski () onet eu]

Hi,
Just wanted to add a quick update on affected systems since I forgot to mention webservers along with wordpress 
versions in my advisory. 
Some people are wondering why the vulnerability doesn't work on their system.

I'm pretty sure that the exploit won't work on web servers other than Apache (as they probably won't process extensions 
other than the last one). So not  apache based servers are probably safe here.  
Whether it will work on your Apache server or not depends on your mod_php configuration.
The exploit won't work on servers where PHP scripts handling has been configured as follows: 

<FilesMatch \.php$>
    SetHandler application/x-httpd-php
</FilesMatch>

If the exploit doesn't work for you this is most likely the case. 

The exploit however will work on systems where php scripts are handled via the following setting in the php.conf:

AddHandler php5-script .php

which I think is quite common. For example Apache distributed in Red Hat based systems seem to have php configured in 
such a way.

Hope this clears the matter a bit. 

Regards,
Dawid