# Did nginx fixed the php/pathinfo exploit in the core?

**URL:** <https://www.ruby-forum.com/t/did-nginx-fixed-the-php-pathinfo-exploit-in-the-core/229263>\
**Category:** NGINX\
**Created:** [December 15, 2012, 8:01am UTC](https://www.ruby-forum.com/t/did-nginx-fixed-the-php-pathinfo-exploit-in-the-core/229263 "2012-12-15T08:01:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![howard\_chen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/bbce88/32.png) [@howard\_chen](https://www.ruby-forum.com/u/howard_chen)\
**Post date:** [December 15, 2012, 8:01am UTC](https://www.ruby-forum.com/t/did-nginx-fixed-the-php-pathinfo-exploit-in-the-core/229263/1 "2012-12-15T08:01:36Z")

</div>

Now tried to test for the exploit (  
[http://forum.nginx.org/read.php?2,88845,88996](http://forum.nginx.org/read.php?2,88845,88996)) , nginx return 403  
directly  
without hitting my backend php

===============

curl -s -D - ‘[http://www.example.com/test.jpg/f.php](http://www.example.com/test.jpg/f.php)’

HTTP/1.1 403 Forbidden

Server: nginx

Date: Fri, 14 Dec 2012 17:40:03 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Access denied.

===============

Which version it was fixed?

Thanks.

---

<div class="post-metadata">

**Author:** ![howard\_chen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/bbce88/32.png) [@howard\_chen](https://www.ruby-forum.com/u/howard_chen)\
**Post date:** [December 15, 2012, 3:20pm UTC](https://www.ruby-forum.com/t/did-nginx-fixed-the-php-pathinfo-exploit-in-the-core/229263/2 "2012-12-15T15:20:51Z")

</div>

On Sat, Dec 15, 2012 at 03:00:53PM +0800, howard chen wrote:

Hi there,

> Now tried to test for the exploit (  
> [http://forum.nginx.org/read.php?2,88845,88996](http://forum.nginx.org/read.php?2,88845,88996)) , nginx return 403 directly  
> without hitting my backend php

> Which version it was fixed?

What’s in your nginx.conf?

The one location that matches /test.jpg/f.php, plus the server-level  
config if relevant?

I suspect it was fixed in “whichever version you used a suitable  
configuration in”.

(But maybe I misunderstood the nature of the problem.)

## f

Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)