Re: [Full-disclosure] FWD: PhotoPost vBGallery ImportantSecurity Bulletin

["php0t" <php0t@xxxxxxxx>]

From: "trains" <trains@xxxxxxxxxxxxxx>
> The "AddType" statement for php is normally system-wide, which means
> the web server will execute php scripts that may be found in the
> upload directory.  This can be fixed multiple ways:

They will just place an .htaccess and do addtype themselves.
"php_admin_flag engine off" will probably render most of the issues you 
mentioned useless in one shot.

p.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/