1

I am conducting a penetration test on a website and am trying to prove that php code can be executed with the file upload. The website allows for file uploads but it checks for:

1: Filetype

2: Extension (Only jpeg or png)

3: File size (Max 2MB).

So, it is possible to upload a file (test.php.png), I therefore thought that adding in PHP code inside the Exif data would run but it does not, why is this?

Improve this question

2 Answers 2

Reset to default
1
  1. To execute injected php code it should be possible to call targeted file directly and its extension must be in the list that server may handle for. By default it is *.php
  2. It is possible to include any file into other php script on the server in case LFI vulnerability is exploitable in the code.
Improve this answer
3
  • Thank you for your helpful answer I however do not completely understand. When uploading the file above I can indeed see that it uploaded correctly and can see where it is uploaded by checking the network. But how would you execute this script? I do not completely understand your second point. Could you elaborate?
    – Jeroen
    Commented Nov 18, 2018 at 13:40
  • @Jeroen, you can not see where file is uploaded during the upload but you could know the place which directory it is located. A secure web application usually rename file name when it move file from tmp storage to the destination.
    – Aleksandr Ryabov
    Commented Nov 19, 2018 at 18:16
  • @Jeroen, You can execute the script if file moved to final destination with *.php ext or it renamed later. The file should be accessible (physically and in correct permission) to perform script. About the 2nd case it could be places in app when an attacker can specify path to file that he uploaded before. As example you can consider APPSEC-1910 case for Magento 2.x. 1.9.x (or 1.8 don't remember) had similar problem.
    – Aleksandr Ryabov
    Commented Nov 19, 2018 at 18:46
0

PHP only will evaluate files that match the .php extension by default. It can be configured to evaluate other/all extensions but that's not a common practice.

PHP will also evaluate files which are referenced via include or requires, but that doesn't seem particularly relevant in this case.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .