Re:Tesla.com/.gitignore
by hsbauauvhabzb on Friday November 25, 2022 @06:08PM
(#33747911)
How is it a good sign of anything like that? File upload to disk is a completely unrelated concept that depends on how php is invoked by the web server.
[ Parent
| on HN ]
Re:Tesla.com/.gitignore
by TechBro8615 on Friday November 25, 2022 @07:24PM
(#33748505)
Sure, I'm just saying it makes an executable file upload more likely. Because if a file like settings.php is executable by Apache, it implies that (at least in this directory) any .php file is executable by Apache, rather than a single whitelisted index.php or some wsgi setup.
So maybe the same configuration applies to a user upload directory. If you find a way to upload a .php file to a web directory on the same server, there is a possibility you can execute it - with higher success probability than if you did not know about settings.php being executable.