0

I'm testing for file upload and the website has an extension and content type check (png/ jpg). But on intercepting using burp, I'm able to change the content to php code (content-type being image/png). The file gets uploaded with .png (not .php) extension. Is this vulnerable?

Improve this question

1 Answer 1

Reset to default
1

First off, you don't have to tamper with the request. Some PHP code could be simply written in EXIF fields or any other metadata field. Or even just bluntly added to the actual binary code of the image before upload.

It means that, in fact, uploading some PHP code is not big deal by itself. I would say most sites allowing image uploads allow it whatsoever. The question is how to activate it.

So to answer your question directly- nope, uploading a php code doesn't make a site vulnerable by itself. What are you looking for is another vulnerability, called LFI, or Local File Inclusion.

Improve this answer
2
  • If the file type check is a simple "$filename contains .png" check, it might end badly if the file is named something like "hack.png.php" and the web server naively executes the PHP file when requested.
    – Birb
    May 13, 2019 at 22:19
  • Unrestricted file uploads may still be problematic, as a malicious user might be able to upload illegal content and then distribute it that way.
    – user163495
    May 14, 2019 at 5:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .