MyBB Community Forums

Full Version: running php files with image tags ?Vulnerability?
You're currently viewing a stripped down version of our content. View the full version with proper formatting.
If I upload my image file to my site, 

I get php URl.

"~/attachment.php?aid=1"

if I use that image URL on another site.

and add the get IP function in my attachment.php.

I can get the IP of people who are viewing my image at another site.
Correct, servers have access to information like IP addresses when their resources are accessed. Third-party sites may prevent it by using a resource proxy (like DVZ Secure Content for MyBB), in which case only the proxy's IP address will be disclosed.
Also note that you can also get the requester's URL with a static resource like a standard JPEG by simply looking at your server's access log.
great ! I learned