Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can someone hack a website that uses this kind of header to open a pdf?


// It will be called downloaded.pdf

// The PDF source is in original.pdf
share|improve this question
up vote 1 down vote accepted

There's no security vulnerability directly in your code.

As an aside, I assume you're using parameterized queries via MySQLi or PDO when doing database calls? If not, you're highly likely to be vulnerable to SQL injection in other parts of your site.

share|improve this answer
Worth pointing out that while this code doesn't contain any vulnerabilities, there could be exploit code in the PDF depending on where it came from, which could be leveraged to attack the browser and then in turn the site through the user. – tylerl Aug 6 '12 at 6:33
@tylerl : thanks, tylerl, what do you mean by that? the pdf is only uploaded by the same person, it is not open to anybody willing to upload a file, so the the pdf at the beginning is safe. Can someone use this downloaded pdf to attack the website? Thanks – Paul Aug 8 '12 at 1:13
@Paul He's saying that if a second user can control the PDF somehow, they could infect people. You just have to look out for vulnerabilities that might allow one user to upload a PDF that might overwrite another user's. – Polynomial Aug 8 '12 at 5:44
@Polynomial okay thanks! – Paul Aug 10 '12 at 21:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.