Windows Website security dog upload interception bypass

Windows Website security dog upload interception bypass

Website security dog's upload interception on win bypasses

Upload code:

<?phpif(isset($_POST['submit'])){$upfile = $_FILES['file']['name'];$tempfile = $_FILES['file']['tmp_name'];$ext = trim(get_extension($upfile)); //var_dump($ext);if(in_array($ext,array('php','php3','php5','asp','asa','cer','cdx','aspx','htaccess'))){die('Warning ! File type error..');}$savefile = $upfile;if(move_uploaded_file($tempfile,$savefile)){die('Success upload. FileName: '.$savefile);}else{die('Upload failed..');}}function get_extension($file){return strtolower(substr($file, strrpos($file, '.')+1));}?>


When the uploaded file extension contains some special characters (such as bypass. php? X, here X represents space % 20 or other special characters {% 80-% 99}). the dongle intercepts the file extension phpX and judges it as a legal file, so the upload is successful.

However, using the file name feature of windows, the existing file name is bypass. php and can be parsed.
 
Submit a bypass. phpX. The hex of X is \ x90.
 


 

 
Solution:
Filter extensions containing special characters