0

I'm testing for file upload and the website has an extension and content type check (png/ jpg). But on intercepting using burp, I'm able to change the content to php code (content-type being image/png). The file gets uploaded with .png (not .php) extension. Is this vulnerable?

2

First off, you don't have to tamper with the request. Some PHP code could be simply written in EXIF fields or any other metadata field. Or even just bluntly added to the actual binary code of the image before upload.

It means that, in fact, uploading some PHP code is not big deal by itself. I would say most sites allowing image uploads allow it whatsoever. The question is how to activate it.

So to answer your question directly- nope, uploading a php code doesn't make a site vulnerable by itself. What are you looking for is another vulnerability, called LFI, or Local File Inclusion.

  • If the file type check is a simple "$filename contains .png" check, it might end badly if the file is named something like "hack.png.php" and the web server naively executes the PHP file when requested. – Birb May 13 at 22:19
  • Unrestricted file uploads may still be problematic, as a malicious user might be able to upload illegal content and then distribute it that way. – MechMK1 May 14 at 5:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.