mailing list archives
Re: WordPress <= 2.8.5 Unrestricted File Upload Arbitrary PHP Code Execution
From: g30rg3_x <g30rg3x () gmail com>
Date: Thu, 12 Nov 2009 09:42:21 -0600
The same thing was discussed on WP-Hackers list and it was found
that the problem was introduced by Option +Multiviews...
And also someone point that Option +Multiviews is enabled by default
on cpanel/whm based servers therefore lots of cheap (and not so
cheap) shared hosting providers introduce this behavior that could
potentially be harmful not just to wordpress but any software that
handles uploads and respect the uploaded file extensions.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/