I was trying to reproduce this vulnerability:
According to the explanation, it is possible to bypass a check in a Wordpress plugin by appending a special char after php extension.
I was trying the attack, and the file is uploaded with the name
shell.php<special_char> containing a simple php code
<?php echo "poc"; ?>.
Then I should navigate the shell in
<target>/..../shell.php<special_char> and the source code should be executed.
But how can I exploit this? PHP interpreter observes that the extension is different from
php (it is
php+special_char), so it does not execute the code, it just prints the source text.
In which cases is it possible to exploit a vulnerability that allows uploading files with php extension containing a special character in the end?