Reply to thread

Message: <blockquote data-quote="viraj_slk" data-source="post: 5456130" data-attributes="member: 51932">thanks mchn. i forgot to mention that not only jpg but most of the time no image file type works. but i hv seen cases where many other innocent looking formats, for eg. *.flv working surprisingly well. so the file does not have to be like c100.php . the attacker can rename it to sm like 'butterfly.flv'.  <img src="/styles/default/xenforo/smilies/default/wink.gif"  class="smilie" loading="lazy" alt=";)" title="Wink    ;)" data-shortname=";)" />WPC jst happened to be really vulnerable to shell upload at that time. so the attacker simply took advantage of it. good lesson for all web developers why learning attack techniques and countermeasures is an important part of learning to become a better developer.</blockquote>

Top Bottom