Yesterday I discovered somebody had uploaded this PHP code to my server as a .jpg file via my asp.net MVC application's "Upload your profile picture" form. I believe the attack was unsuccessful for a number of reasons (the images are given random filenames, then resized, and they're stored in a non-execute directory). The file was leftover because I failed to clean up the temporary file if the resizing failed, which I've now fixed.
But it worries me that I don't understand what the next step of this attack would be...Say he'd successfully uploaded a .jpg file that had malicious PHP code in it to my Windows/IIS server, and he knew the file's URL. Now what? He would need to get IIS to interpret that .jpg file as PHP code rather than an image, right? What might his plan have been to accomplish that?
The only thing I can think of is if it were an apache server and .php files were being filtered out but .htaccess files weren't, he maybe could have managed it. Is there any equivalent approach that might have worked in IIS?