Website security dog File Upload bypass 2 (Windows + apache)

Website security dog File Upload bypass 2 (Windows + apache)

Website security dog (APACHE version) for Windows 3.5.11730

Attackers can bypass the extended ascii code.

The test shows that the expanded ascii code added to the file suffix can bypass the upload protection, such as 0x7f, 0x88, 0xb0, 0xc0, 0xaa, 0xe0, and 0xee.


Website security dog (APACHE version) for Windows

Main program version: 3.5.11730

Tested network horse library version:

Test environment: vmware Windows xp sp3, apache + php + mysql Integrated Environment


Test process:

Directly uploading PHP files will be blocked:
 

In this case, an extended ascii Code such as 0xcc is added after 22. php and the upload is successful:
 

 

 

 

Solution:

In file name processing, the special characters mentioned above are processed as appropriate.