Other nomination
Passing Malicious PHP Through getimagesize()
Michael Schramm's finding, relayed by RSnake: PHP can be embedded in an 8x8 GIF that still passes getimagesize(). Inserting /* before the header's illegal bytes makes PHP skip them, so the file validates as an image and executes phpinfo() when requested. Breaks upload filters that trust getimagesize() and keep the original filename.
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.