I have a small web application. Because it is necessary to upload some files I check the file extensions with a whitelist (tgz, jpg, png, pdf, zip, rar, txt, gif, py, c, rb). In addition to that, I hash the filenames with md5 so e.g. when the user uploads the file exploit.php.jpg it is renamed to 526a8f9f3497b5a69bc4523ba0c6aacd.jpg.

There is neither a MIME-Type verification nor a getimagesize() or resize-function, if it is a picture. Because of that it is possible to upload a php-file that is just renamed to exploit.jpg

Although this seems to be very risky and the user also knows, where this file exists on my server (/images/526a8f9f3497b5a69bc4523ba0c6aacd.jpg), I am not able to run this file as a .php.

When I try to open /images/526a8f9f3497b5a69bc4523ba0c6aacd.jpg%00 or /images/526a8f9f3497b5a69bc4523ba0c6aacd.php and so on.. I only get "file not found" (for .php) or "image can not be displayed" (for jpg, gif).

Does anyone know if and how it is possible to exploit that fileupload?

  • 2
    py and rb? Do you have an interpreter that would execute these files?
    – KDEx
    Nov 18, 2014 at 17:35
  • 5
    Have you considered null byte injections? Meaning upload a file called exploit.php%00.jpg? Personally I think you should read the first bytes of the file in order to determine the file header. File extension checking by itself is not sufficient enough in my humble opinion.
    – Jeroen
    Nov 18, 2014 at 18:34
  • Have a look at how you can determine the file header: it.php.net/manual/en/function.finfo-file.php
    – Jeroen
    Nov 18, 2014 at 18:44
  • @KDEx there is no python or ruby interpreter installed. When I try to open these files, my browser only offers to download these files Nov 18, 2014 at 21:52
  • In a vacuum with the correct web server config, this seem sound. I will assume that your file validation code isn't flawed. However it may be possible to chain attacks as stated in other answers, local file include bugs or hosting an indirect attack like a zipped virus, cross site scripting or phishing page may still be possible and can attack users of the website. While your design seems ok, implementation flaws could still lead to code execution. I have seen fileupload validation that calls /usr/bin/file uploadfilename for mimetypes and would lead to command injection
    – wireghoul
    Jul 16, 2021 at 0:07

3 Answers 3


It's possible if you have a LFI in hand. Imagine you have a page like this


http://victimIP&Port/?page=../../../../var/www/payload.jpg <- not found since the filename hash

Then it could be executed like PHP files. In your case


You just need to find the LFI vendor for the hashed files.


The file upload vulnerability could be exploited in combination with a local file inclusion bug to attack the server side. Or a malicious file (ie: pdf) could be uploaded to attack an end user with administrative privileges for example.

Your approach seems reasonable enough, however the devil is always in the details and you would need someone with security knowledge to take a look at your source code or running application for a more robust assessment.


Don't trust a whitelist, it can be bypassed:

Content-type: image/jpeg; filename=exploit.php

Hashing the files does not protect you if the attacker can access the file direct:

<img src='http://yoursite.net/images/526a8f9f3497b5a69bc4523ba0c6aacd.jpg>

You could create a PHP script to read the file and send the contents to the user, unchanged. This way, the attacker will never reference the file on your server, and whatever server side exploit he could upload would not trigger:


$filename = getFilenameFromDatabase();
// e.g: $DOCROOT/images/exploit.rb.exe.py.bat.scr.php.jpg
header("Content-type: image/jpeg");

Just make sure to filter the path to the files, otherwise the attacker can get read access of your files.

  • Thank you for your answer. So the only way to use this vulnerability is, when I can manage to include the uploaded file in my php code? I tried <img src='exploit.jpg'> but nothing happend; only a "failed image" symbol is shown. Nov 19, 2014 at 15:20
  • 4
    The whitelist bypass does not apply there. He whitelists the extensions, not MIME types, so your attack will not work.
    – v6ak
    Jan 17, 2015 at 18:44
  • He didn't post the extension validation code so it may still be vulnerable to bypasses.
    – wireghoul
    Jan 28, 2015 at 4:59
  • Why OP should not trust a white list, assuming the extension validation is correct (php already has a function for this)? What the img is supposed to do besides fetching a public image? Sep 19, 2022 at 15:09
  • There are functions to see if a image is a image, but there are certain kinds of files that may behave on distinct ways depending on who is calling them, they are called polyglots. You can have a jpeg file encapsulating a PHAR file, and that single file will be identified as jpeg by image functions, and executed as PHAR by PHP.
    – ThoriumBR
    Sep 19, 2022 at 15:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.