id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
3531	ImageField - possible script injection	Piotr Maliński <riklaunim@…>	Adrian Holovaty	"ImageField field validates files using MIME which isn't 100% ok. It will allow uploading *py *php *pl or any other file extension when it will have image MIME signature at the beginning:
{{{
cat image.png code.php > upload_me.php
}}}
It's dangerous for shared hosting and other where media folders can execute scripts like PHP where <?PHP starts the code and makes the binary image part meaningless for the interpreter ([http://www.fotosik.pl/showFullSize.php?id=3a0f587509d2b2d0 could look like this]).

Example: [http://www.fotosik.pl/showFullSize.php?id=497419b9cfb92838 screenshot] - 11.py uploaded as image. '''Check the extensions'''
"		closed	Database layer (models, ORM)	dev		invalid		sam@…	Unreviewed	0	0	0	0	0	0