I am testing a web application and I found a file upload vulnerability where I can upload php files to the server with the ability to know the path.
The issue is that when I go to the file path, the php file (which is my shell) gets downloaded. I need help to find a way to execute the file instead. Any ideas I should try?
A file upload feature which lets you upload PHP scripts isn't a vulnerability by itself. According to your description, the webserver doesn't execute PHP scripts in the upload directory, so there seems to be at least some protection against code execution attacks.
There are (at least) two options which might allow you to still execute code. However, note there's no guarantee for successful code execution. It may very well turn out that there's no vulnerability at all.
Using a path traversal attack, you could try to make the webserver store the uploaded files in a directory which does support script execution. Whether or not this is possible depends on how exactly the upload feature constructs the target path for the file. For example, typical PHP code for storing an uploaded file looks like this:
move_uploaded_file($tmp_name, $upload_dir.$some_infix.$filename);
The variable $upload_dir is going to contain the path of the (legitimate) upload directory, $filename is the target filename provided either by you or the server, and $some_infix is a (possibly empty) string of, for example, a subdirectory within the upload folder or a prefix to the filename.
You can try to inject path segments (like ../some-executable-dir-above-the-upload-folder) both through $filename and $some_infix. If $filename uses the name key of $_FILES, then it's not injectable, because this value is automatically stripped of any path information. However, PHP 8.1 has introduced the full_path key which allows the client to provide a complete path. If you're lucky, the upload feature uses full_path instead of name. If you cannot inject path segments through the filename, then check if you can control the $some_infix (if one exists). For example, if the files are prefixed with your username, that might be an option to inject slashes.
If you cannot escape the upload directory, then the second option would be to find a local file inclusion vulnerability in an existing script. If this script allows you to specify the path of your uploaded PHP script, then this might lead to code execution.
