I was trying to reproduce this vulnerability:
https://www.exploit-db.com/exploits/49294
According to the explanation, it is possible to bypass a check in a Wordpress plugin by appending a special char after php extension.
I was trying the attack, and the file is uploaded with the name shell.php<special_char>
containing a simple php code <?php echo "poc"; ?>
.
Then I should navigate the shell in <target>/..../shell.php<special_char>
and the source code should be executed.
But how can I exploit this? PHP interpreter observes that the extension is different from php
(it is php+special_char
), so it does not execute the code, it just prints the source text.
In which cases is it possible to exploit a vulnerability that allows uploading files with php extension containing a special character in the end?