I am conducting a penetration test on a website and am trying to prove that php code can be executed with the file upload. The website allows for file uploads but it checks for:

1: Filetype

2: Extension (Only jpeg or png)

3: File size (Max 2MB).

So, it is possible to upload a file (test.php.png), I therefore thought that adding in PHP code inside the Exif data would run but it does not, why is this?

  1. To execute injected php code it should be possible to call targeted file directly and its extension must be in the list that server may handle for. By default it is *.php
  2. It is possible to include any file into other php script on the server in case LFI vulnerability is exploitable in the code.
| improve this answer | |
  • Thank you for your helpful answer I however do not completely understand. When uploading the file above I can indeed see that it uploaded correctly and can see where it is uploaded by checking the network. But how would you execute this script? I do not completely understand your second point. Could you elaborate? – Jeroen Nov 18 '18 at 13:40
  • @Jeroen, you can not see where file is uploaded during the upload but you could know the place which directory it is located. A secure web application usually rename file name when it move file from tmp storage to the destination. – Aleksandr Ryabov Nov 19 '18 at 18:16
  • @Jeroen, You can execute the script if file moved to final destination with *.php ext or it renamed later. The file should be accessible (physically and in correct permission) to perform script. About the 2nd case it could be places in app when an attacker can specify path to file that he uploaded before. As example you can consider APPSEC-1910 case for Magento 2.x. 1.9.x (or 1.8 don't remember) had similar problem. – Aleksandr Ryabov Nov 19 '18 at 18:46

PHP only will evaluate files that match the .php extension by default. It can be configured to evaluate other/all extensions but that's not a common practice.

PHP will also evaluate files which are referenced via include or requires, but that doesn't seem particularly relevant in this case.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.