Description:
------------
The install instructions for *nix + Apache suggest a *potentially* *less secure* configuration of Apache. 

http://www.php.net/manual/en/install.unix.apache2.php

"AddType application/x-httpd-php .php .phtml"

The potential vulnerability involves how Apache handles files with multiple extensions. A file named exploit.php.xx.xx will be interpreted as PHP; so if a file was uploaded, a simple check on its extension against a blacklist (.php, .cgi etc) would allow a .php.xx.xx file to pass.

Put aside the issue of developer stupidity: instead of the AddType... configuration, we could change it to:-

<FilesMatch \.php$>
SetHandler application/x-httpd-php
</FilesMatch>

Which I don't think has any side-effects and means only files with extension .php would be interpreted. 


Reproduce code:
---------------
[Vanilla Apache+PHP installation from source]

Filename: exploit.php.xx.xx
<?php
echo "Oh shit, this ran through PHP!";
?>

When you request http://localhost/exploit.php.xx.xx it will be interpreted by PHP.