Here is the code:

//echo $file;

if (file_exists($file)) {
    header('Content-Description: File Transfer');
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename='.basename($file));
    header('Content-Transfer-Encoding: binary');
    header('Expires: 0');
    header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
    header('Pragma: public');
    header('Content-Length: ' . filesize($file));

Is there any possibility of RCE? I am a web developer and developing a website for my client.

  • Your code is vulnerable to LFI attacks if openbase_dir is not set in php.ini. I am not sure why you think an LFI is related to RCE. You only read local files, this by itself will not lead (directly) to RCE. – Jeroen Sep 6 '19 at 6:19
  • When speaking of RCE, do you mean Remote Command Execution or Remote Code Execution. My previous answer was about command execution. – Jeroen Sep 6 '19 at 6:23
  • I referred to RCE as Remote Command Execution – Dangu OP Sep 6 '19 at 6:34
  • I would recommend scanning this endpoint with a web app scanner like OWASP ZAP. – Saustin Sep 7 '19 at 1:45

You should check for directory traversal and for file type for the requested file.

Directory traversal:

Use realpath() function

echo realpath('./../../etc/passwd') . PHP_EOL;

echo realpath('/tmp/') . PHP_EOL;

File type

$allowed =  array('gif','png' ,'jpg');
$filename = $_FILES['video_file']['name'];
$ext = pathinfo($filename, PATHINFO_EXTENSION);
if(!in_array($ext,$allowed) ) {
    echo 'Invalid file type requested only images are allowed!';

RCE is not in any way possible with only this method.

  • One should also check for chatacters in filename. Newline can be a perfectly valid character in filename, but it would cause header injection. – v6ak Oct 6 '19 at 19:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.