不能说是漏洞，只是 apache 特性而已。
下面是apache httpd.conf中截取的一段：
<IfModule mime_module> # # TypesConfig points to the file containing the list of mappings from # filename extension to MIME-type. # TypesConfig conf/mime.types # # AddType allows you to add to or override the MIME configuration # file specified in TypesConfig for specific file types. # #AddType application/x-gzip .tgz # # AddEncoding allows you to have certain browsers uncompress # information on the fly. Note: Not all browsers support this. # AddEncoding x-compress .Z AddEncoding x-gzip .gz .tgz # # If the AddEncoding directives above are commented-out, then you # probably should define those extensions to indicate media types: # AddType application/x-compress .Z AddType application/x-gzip .gz .tgz AddType application/x-httpd-php .php AddType application/x-httpd-php .php3 # # AddHandler allows you to map certain file extensions to "handlers": # actions unrelated to filetype. These can be either built into the server # or added with the Action directive (see below) # # To use CGI scripts outside of ScriptAliased directories: # (You will also need to add "ExecCGI" to the "Options" directive.) # #AddHandler cgi-script .cgi # For type maps (negotiated resources): #AddHandler type-map var # # Filters allow you to process content before it is sent to the client. # # To parse .shtml files for server-side includes (SSI): # (You will also need to add "Includes" to the "Options" directive.) # #AddType text/html .shtml #AddOutputFilter INCLUDES .shtml </IfModule>
由上可知道，.php 或 .php3后缀的文件会被php解析。
Index.php.a文件有两个后缀，分别是.php和.a，apache无法识别.a但可以识别.php，然后件给php去解析。
如果去掉后缀 （.php） ，则无法解析，按照默认设置（DefaultType text/plain），对于无法识别的后缀，按纯文本发给浏览器。
如下图（.a后缀无法识别，按默认）：
如果在 httpd.conf 中添加AddType application/x-httpd-php .a如图:
Apache按从右到左的顺序识别文件后缀，直至找到后缀能匹配配置文件中的设置。index.php.txt，将会被识别为纯文本（text/plain）；
index.php.Z将会被识别为压缩文件。Index.php.a 若.a没有被设置或mime.types没有定义，则会识别为.php后缀的文件，交给php解析。
在mine.types中设置后缀匹配识别：
