Posted by HI-TECH . on Jun 18
This technique describes how to exploit apps which encode pictures during a
Php upload. Embedding Php code inside gif files which are uploaded is a
known technique to execute arbitrary code on a Apache Php installation. Now
what can one do when the code which uploads the file processes and encodes
the file to a thumbnail and only this thumbnail is accessible remotely with
the correct extension? The gif file is crunshed and the embedded Php code…
