I have a small web application. Because it is necessary to upload some files I check the file extensions with a whitelist (tgz, jpg, png, pdf, zip, rar, txt, gif, py, c, rb). In addition to that, I hash the filenames with md5 so e.g. when the user uploads the file "exploit.php.jpg" it is renamed to "526a8f9f3497b5a69bc4523ba0c6aacd.jpg".
There is neither a MIME-Type verification nor a "getimagesize()" or resize-function, if it is a picture. Because of that it is possible to upload a php-file that is just renamed to exploit.jpg
Although this seems to be very risky and the user also knows, where this file exists on my server (
/images/526a8f9f3497b5a69bc4523ba0c6aacd.jpg), I am not able to run this file as a .php.
When I try to open
/images/526a8f9f3497b5a69bc4523ba0c6aacd.php and so on.. I only get "file not found" (.php) or "image can not be displayed" (jpg, gif).
Does anyone know if and how it is possible to exploit that fileupload?