“A very few day ago i had to face the situation where hacker uploaded the malicious ASP script to the web server by changing its extension to .JPG through user interface which allow user to upload image file. Although developer team had put the validation on extension. But unfortunately extension of ASP script was .JPG and hence it is allowed extension. So hacker could upload that malicious script.
After this situation i thought just checking only extension for uploaded file is not the sufficient. We need to check content as well of the uploaded file.”
Read More : http://www.dotnetexpertguide.com/2011/05/validate-uploaded-image-content-in.html
Aucun commentaire:
Publier un commentaire