I am conducting a penetration test on a website and am trying to prove that php code can be executed with the file upload. The website allows for file uploads but it checks for:
2: Extension (Only jpeg or png)
3: File size (Max 2MB).
So, it is possible to upload a file (test.php.png), I therefore thought that adding in PHP code inside the Exif data would run but it does not, why is this?