[Misdetection] PHP file misdetected as image when image is injected at the start of the file
Open
misdetection
- Dominant language
- Rust
- Stars
- 18.6k
- Forks
- 1.2k
- Avg merge
- 3d 12h
- Merged PRs (30d)
- 20
Description
If you take an image file, append PHP code to it (and rename to .PHP) it will be recognized as image. Old PHP code injection vulnerabilities were possible with such files when the code used a bad source of mime type detection.
Example file (PNG icon with phpinfo at the end):
[example.zip](https://github.com/google/magika/files/15380904/example.zip)
Contributor guide
Assessment
This issue has not been assessed yet.