hello admin, please check this

  • Resolved dlehsus

    (@dlehsus)


    10 years, 10 months ago

    I think your application is useful and good but the plugin can be uploaded through the shell file of the changed file extension like this “c99shell.php” -> “c99shell.php.jpg” the jpg file is loaded php file. I think you should add some code for filtering.

    I can’t speak English well . So I’m afraid you will not understand well. If you need more information please ask me more questions. thank you.

    https://ww.wp.xz.cn/plugins/wp-file-upload/

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Author nickboss

    (@nickboss)

    10 years, 10 months ago

    Hi dlehsus

    Thank you very much. What you mean is that file c99shell.php.jpg seems to be a jpg file, but in reality it is a php file? So, when it is uploaded from the plugin, it can be executed as a php file?

    Do you know any other cases like this (for instance .php.png or other)?

    Thank you

    Nickolas

    Thread Starter dlehsus

    (@dlehsus)

    10 years, 10 months ago

    c99shell.php is hacking tool like backdoor. if the file is uploaded on website ,attacker can control the server.

    I’ve tried other cases (for instance .php.png or other) . changed file extension of pictures can use like upside way. it’s very old attack method ,I think you should check and investigate it for filtering 🙂

    p.s When we upload on “file upload of main wordpress”, php.jpg file changed like php_.jpg. under bar added behind ‘php’ and the php file can’t be excuted as a php file.

    Thank you

    Donghyun

    Plugin Author nickboss

    (@nickboss)

    10 years, 10 months ago

    thanks again, I made some research, I will make some improvements in filtering so that this kind of files are not executed and release a new version

    Nickolas

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘hello admin, please check this’ is closed to new replies.