PHP embedded in GIF files

There is a security flaw in GIF files that allows a PHP program to be inserted into the GIF file. The way this works is the file has the proper GIF89 headers to make it a valid file (thus not caught by a PHP upload script), but yet the PHP code is embedded. A hacker can use it to find out passwords, etc, since the .php code would run as the webhost.

I never knew this was possible until I read about it when someone tried it on our server.

This site has what you can do about it...
http://www.phpclasses.org/blog/post...GIF-images.html