1
vote
1answer
111 views

A renamed exe automatically running

We are currently developing a web app that allows users to upload files to act as attachments to information they provide. Obviously allowing users to upload any file types is very dangerous, ...
5
votes
1answer
2k views

.JPEG File upload shell via EXIF comments

I came across this advisory recently and I'm a bit confused by both exploits, but specifically the file upload vulnerability. I don't understand how to actually exploit this condition (or even why ...
-1
votes
6answers
4k views

Use PHP to check uploaded image file for malware?

I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k. Is there any way for me to check uploaded ...
2
votes
1answer
211 views

Is it safe to invoke PHP GD functions if you don't know whether file is a valid image?

There is image upload function in web application. After image is uploaded, it's resized using functions from PHP GD like imagecopyresampled and others. Before invocation of PHP GD's functions there ...
7
votes
3answers
4k views

Is it possible to inject HTML into image to provoke XSS?

Some answers mention that it's possible to inject attacker-controlled HTML into images and therefore provoke XSS. I guess that this HTML will be processed by browser only if hole exists in browser. ...
6
votes
5answers
623 views

How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web?

My website will be hosting documents for end users and I would like to make this as secure as possible. Question Assuming that I have a need to share documents on a website that may contain hostile ...
5
votes
2answers
2k views

Exploits or other security risks with SVG upload?

I have a site, where people can upload graphics, you might think of it like an image hoster or a forum for pictures. Now, I allow upload of raster graphics to a certain size, but no vector graphics ...
16
votes
3answers
2k views

How can I be protected from pictures vulnerabilities?

I've just read this question What is the corrupted image vulnerability? How does it work? (GIFAR, EXIF data with javascript, etc..) I'm asking myself how can I protect myself and my website's users. ...