ImageFight

Recently it was reported that some picture files buried within the attack code of PHP was discovered on the major hosting site.

The RFI attack of PHP code can be buried within GIF, PNG, JPEG, and other picture files.

PHP code in GIF image file (sample)

phpinfo.gif

  

include.php

<h1>PHP/GIF include demo</h1>
<?php
include("./phpinfo.gif");
?>

Result