File Upload with changed extension

Jyotiranjan Acharya <[email protected]> Tue, 2 Dec 2014 12:44:23 -0600

Newsgroups	gmane.comp.security.web-applications
Message-ID	<CAGZfuitnOw12xbi2t2w0X+yw19okhWvFH_00arCBahZ5h7gAsg@mail.gmail.com>

If you are able to upload a file with a changed extension, then will
that be a problem?
For example, you can not ,in any way, upload a .exe  or .php/.jsp/.asp
file directly into a web App, but you can by changing their extension
to .JPG. What is the risk in such a case?



This list is sponsored by Cenzic
--------------------------------------
Let Us Hack You. Before Hackers Do!
It's Finally Here - The Cenzic Website HealthCheck. FREE.
Request Yours Now! 
http://www.cenzic.com/2009HClaunch_Securityfocus
--------------------------------------