# File upload vulnerability: rename solution?

I have a module in which the user can upload images.

• checking dimension of the image (still vulnerable)
• checking of file extension mypicture.php%00.jpg (still vulnerable)
• checking of mime type (still vulnerable)
The only solution that I have is to change the file name of uploaded file
e.g:
move_uploaded_file(\$_FILES["pictures"]["tmp_name"] , 'mycustomname'.'jpg');

My question is:
Is there still a way to upload shell file after I've taken these precautions?

• Add a check to alert the administrator if the folder that will receive the images has any execution permission, so that new files stored in that directory do not have it. – DarkLighting Feb 25 '16 at 21:59

You need to do a few more things:

• Check the file size of the image and enforce a limit (prevent overflows from happening)
• Along with renaming the file (and storing it with a different name and path than the uploader can recover, preferably on a separate domain), you should also rewrite the file in some minor way (add a bit of random noise) with a tool like ImageMagick.
• Extract EXIF (and any other similar meta-data) from the file, or just consider converting every image to a bitmap.

Most important -- understand how the executable image exploits work: