Full Disclosure mailing list archives
Re: Paper: Secure file upload in PHP web applications
From: Nikolay Kichukov <hijacker () oldum net>
Date: Fri, 15 Jun 2007 10:44:41 +0300
Very nice presentation. Thanks a lot for sharing with us. Regards, -Nikolay Kichukov Alla Bezroutchko wrote:
Various web applications, such as blogs, forums and photo galleries allow users to upload files. Providing file upload function without opening security holes proved to be quite a challenge in PHP web applications. The applications we have tested suffered from a variety of security problems, ranging from arbitrary file disclosure to remote arbitrary code execution. The paper describes various security holes occurring in file upload implementations and suggests a way to implement a secure file upload. The paper can be downloaded from http://www.scanit.be/uploads/php-file-upload.pdf Regards, Alla Bezroutchko Scanit http://www.scanit.be/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Paper: Secure file upload in PHP web applications Alla Bezroutchko (Jun 14)
- Re: Paper: Secure file upload in PHP web applications Nikolay Kichukov (Jun 15)