[Full-disclosure] Paper: Secure file upload in PHP web applications
alla at scanit.be
Thu Jun 14 14:35:54 BST 2007
Various web applications, such as blogs, forums and photo galleries
allow users to upload files. Providing file upload function without
opening security holes proved to be quite a challenge in PHP web
applications. The applications we have tested suffered from a variety of
security problems, ranging from arbitrary file disclosure to remote
arbitrary code execution.
The paper describes various security holes occurring in file upload
implementations and suggests a way to implement a secure file upload.
The paper can be downloaded from
Full-Disclosure is hosted and sponsored by Secunia.