From: paul at castlecops dot com Operating system: Linux PHP version: 4.4.2 PHP Bug Type: EXIF related Bug description: PHP Payload in JPG Exif Header is Executed by PHP
Description: ------------ Affected Versions: PHP 5.1.4 and 4.4.2 The PHP server evaluates code inside a technically valid JPEG's technically valid Exif header. It'll evaluate it even if exif is not compiled into PHP. Reproduce code: --------------- I need to attach it. Expected result: ---------------- The POC jpg will write a file to the filesystem and include whatever PHP code there is. Anything is possible given the permissions of the web server. Actual result: -------------- The POC jpg will write a file to the filesystem and include whatever PHP code there is. Anything is possible given the permissions of the web server. -- Edit bug report at http://bugs.php.net/?id=37467&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=37467&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=37467&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=37467&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=37467&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=37467&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=37467&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=37467&r=needscript Try newer version: http://bugs.php.net/fix.php?id=37467&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=37467&r=support Expected behavior: http://bugs.php.net/fix.php?id=37467&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=37467&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=37467&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=37467&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=37467&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=37467&r=dst IIS Stability: http://bugs.php.net/fix.php?id=37467&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=37467&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=37467&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=37467&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=37467&r=mysqlcfg
