[Full-disclosure] Paper: Secure file upload in PHP web applications

[Alla Bezroutchko]

Various web applications, such as blogs, forums and photo galleries
allow users to upload files. Providing file upload function without
opening security holes proved to be quite a challenge in PHP web
applications. The applications we have tested suffered from a variety of
security problems, ranging from arbitrary file disclosure to remote
arbitrary code execution.

The paper describes various security holes occurring in file upload
implementations and suggests a way to implement a secure file upload.

The paper can be downloaded from
http://www.scanit.be/uploads/php-file-upload.pdf

Regards,
Alla Bezroutchko
Scanit
http://www.scanit.be/