Re: WordPress 2.8.5 Unrestricted File Upload Arbitrary PHP Code Execution

Hi,
Just wanted to add a quick update on affected systems since I forgot to mention webservers along with wordpress versions in my advisory. 
Some people are wondering why the vulnerability doesn't work on their system.

I'm pretty sure that the exploit won't work on web servers other than Apache (as they probably won't process extensions other than the last one). So not  apache based servers are probably safe here.  
Whether it will work on your Apache server or not depends on your mod_php configuration.
The exploit won't work on servers where PHP scripts handling has been configured as follows: 

<FilesMatch \.php$>
    SetHandler application/x-httpd-php
</FilesMatch>

If the exploit doesn't work for you this is most likely the case. 

The exploit however will work on systems where php scripts are handled via the following setting in the php.conf:

AddHandler php5-script .php

which I think is quite common. For example Apache distributed in Red Hat based systems seem to have php configured in such a way.

Hope this clears the matter a bit. 

Regards,
Dawid