Collaborate Disseminate
Our work website is getting flooded with these types of hacks:
The files are getting uploaded throughout the entire site (not just the url shown in the picture). I our site is still up and running fine, as far as I can tel… Continue reading WordPress – blocked by firewall for Malicious File Upload
I’m writing a PHP script that takes input from an HTML5 form, including uploads, and emails them to an administrator using Magento’s mail client. I think I’ve covered the basics pretty well, but I’m sure I’m missing some pote… Continue reading Vulnerabilities in PHP Form Handling Script
In a PHP file upload form, the name and extension of the file should be changed in order to prevent directory traversal attacks. I don’t fully understand these attacks, therefore I’m uncertain if some of my other security che… Continue reading PHP file upload: Order of security measures
A few days ago, there were a few files that may have been plagued by a virus that I asked my colleague to send me through a file sharing service (here, WeTransfer).
The files were sent correctly and were without any viruses…. Continue reading file transfer/sharing/hosting services: Are the antivirus natively incorporated?
Is there a possibility, that an uploaded File that is plain text can cause command injection? Like on Unix with injecting commands like ‘rm’ etc?
Or is there anything else that could possibly go wrong? Like buffer overflow o… Continue reading File Upload (AspNet MVC)
The dotCMS administration panel is vulnerable to cross-site request forgery,and the"Push Publishing"feature in Enterprise Pro is vulnerable to path traversal and arbitrary file upload. dotCMS versions 3.7.1 and earlier are affected. Continue reading VU#168699: dotCMS contains multiple vulnerabilities
Is storing an image outside of the webserver root with a new name and extension (e.g. using move_uploaded_file($_FILES[‘userfile’][‘tmp_name’],’../uploads/’.date(‘U’).’png’) – not exactly this, obviously, since date(‘U’) is n… Continue reading Serving image from outside web server root
Situation:
User has several folders worth of GBs which they want to keep in
sync on a cloud service (for example Mega or Dropbox) in an encrypted form;
User does not want to sync a single encrypted volume, because this
would mean, obviou… Continue reading Keep encrypted files in sync on a cloud service, without having to upload an entire encrypted volume each time
There are a few questions on this site about secure image uploads, such as this one, but that question is 4 years old, and contains contradictory information.
For instance, the most highly upvoted answer recommends using geti… Continue reading Secure Image upload [on hold]
I think in a PHP file upload it is a best practice to store files outside of the document root with a randomly generated file name and telling the server to make them non-executable, so the file will not be executed by an attempt to access… Continue reading Changing file extensions in PHP file upload to prevent code execution?