I have a module in which the user can upload images.
I searched Google for different kinds of upload attacks
- checking dimension of the image (still vulnerable)
- checking of file extension mypicture.php%00.jpg (still vulnerable)
- checking of mime type (still vulnerable)
The only solution that I have is to change the file name of uploaded file
move_uploaded_file($_FILES["pictures"]["tmp_name"] , 'mycustomname'.'jpg');
My question is:
Is there still a way to upload shell file after I've taken these precautions?