Nginx Filename Logic Vulnerability (CVE-2013-4547)

Nginx 1.4.2 passing *.php to PHP-FPM, with an upload page that refuses PHP extensions, vulnerable to CVE-2013-4547: a request for "shell.gif \0.php" matches the PHP location while Nginx resolves the file "shell.gif ", so an uploaded image runs as PHP.

Pas commencé·Docker·commit d55115b·x86_64 · aarch64·Secret