Image uploads (any files in general) are very hard to code securely completely - especially in PHP, which provides many attack vectors.

If you, for example display the image by calling

require($filename);

and that file has php code inside, it may be interpreted and executed as such.

My guess is, if he claims he's owned your site, he most probably has. The image you've provided in itself won't do anything except print "test ok", but that code could easily be exchanged for some that gives unauthorized (even completely unrestricted) access to your site and server.

Image uploads (any files in general) are very hard to make completely secure - especially in PHP, which provides many attack vectors.

If you, for example display the image by calling

require($someImage);

and that image has PHP code inside (like the one you posted), it may be interpreted and executed as such.

My guess is, if he claims he's owned your site, he most probably has. The image you've provided in itself won't do anything except print "test ok", but that code could easily be exchanged for some that gives unauthorized (even completely unrestricted) access to your site and server.

To make sure the file uploaded to your site is in fact an image, re-process it using GD (or Imagick), and save the processed image. It's bad practice to save the original image, especially using the original file name, as this opens up for many other attacks (for example directory traversal and file overwriting).

More information: https://www.owasp.org/index.php/Unrestricted_File_Upload