[Full-disclosure] Original Photo Gallery Remote Command Execution

[Andrew Farmer]

On 03 Oct 07, at 02:10, Aidan Thornton wrote:
> On 10/2/07, ascii <ascii at katamail.com> wrote:
>> X. LEGAL NOTICES
>>
>> Copyright (c) 2007 Francesco `ascii` Ongaro
>>
>> Note: this exploit is DUAL LICENSED,
>> 1. if you'll use it for personal and non-profit purposes you can
>>    apply GPL v2 and above.
>>
>> 2. In the case you plain to:
>>    a. use our code in any commercial context
>>    b. implement this code in your non-GPL application
>>    c. use this code during a Penetration Test
>>    d. make any profit from it
>>
>>   you need to contact me in order to obtain a _commercial license_.
>>
>> For more informations about Dual Licensing:
>> http://producingoss.com/html-chunk/dual-licensing.html
>
> I think you're misunderstanding the GPL. "GPL, but only for personal
> and non-profit purposes" isn't a valid license since the GPL doesn't
> permit restrictions on commercial use.

In fact, the GPL doesn't permit any restrictions on usage at all. It
only covers distribution.

Probably a moot point anyway, as the actual exploit is trivial enough
that it isn't covered by copyright. (The discovery that you can use
register_globals to set exif_prog isn't a creative work.)