bugtraq - Re: WordPress 2.8.5 Unrestricted File Upload Arbitrary PHP Code Execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20091112215530.20025.qmail@securityfocus.com>
Date: 12 Nov 2009 21:55:30 -0000
From: golunski@...t.eu
To: bugtraq@...urityfocus.com
Subject: Re: WordPress 2.8.5 Unrestricted File Upload Arbitrary PHP Code
 Execution

Hi,
Just wanted to add a quick update on affected systems since I forgot to mention webservers along with wordpress versions in my advisory. 
Some people are wondering why the vulnerability doesn't work on their system.

I'm pretty sure that the exploit won't work on web servers other than Apache (as they probably won't process extensions other than the last one). So not  apache based servers are probably safe here.  
Whether it will work on your Apache server or not depends on your mod_php configuration.
The exploit won't work on servers where PHP scripts handling has been configured as follows: 

<FilesMatch \.php$>
    SetHandler application/x-httpd-php
</FilesMatch>

If the exploit doesn't work for you this is most likely the case. 

The exploit however will work on systems where php scripts are handled via the following setting in the php.conf:

AddHandler php5-script .php

which I think is quite common. For example Apache distributed in Red Hat based systems seem to have php configured in such a way.

Hope this clears the matter a bit. 

Regards,
Dawid